Power Brunch: Nigeria’s data sovereignty push goes beyond local servers

With Nigeria’s financial sector facing a January 1, 2027, deadline to comply with the Central Bank of Nigeria’s data-localisation rules, the country’s debate over data sovereignty is moving beyond a simple question of where servers are located.

The practical questions are becoming harder: What happens to backups? Who can access the data? Where is it analysed? Can critical systems operate independently of overseas infrastructure? And does Nigeria have enough local capacity to support the transition without raising costs or creating new risks?

Those questions will come into focus on Thursday, September 10, when TechCabal Insights, in partnership with Amazon Web Services (AWS) Partner Network, hosts its Power Brunch, bringing together CEOs, CTOs, regulators, financial services executives, cloud providers, infrastructure companies and other technology leaders to examine what data localisation means in practice.

For Femi Olugbesan, co-founder and chief information officer of Descasio and one of the speakers at the upcoming event, the distinction between localisation and sovereignty is critical.

“Changing the address of the data is not the same as having sovereignty over it,” Olugbesan said.

The CBN’s June 15, 2026, directive requires banks, fintechs, mobile money operators and payment switching networks to keep payment transaction data generated in Nigeria within the country. The requirements extend beyond primary databases to backups, disaster recovery, and logs, while data management must also remain locally governed.

But moving a database from an overseas environment to a Nigerian data centre addresses only one part of the problem.

A bank could host its primary records in Lagos and still send information abroad for analytics, technical support, security monitoring, or backup. The data may be physically inside Nigeria, while important parts of its operational lifecycle remain outside the country.

“The real work is understanding the full life of the data — where it is created, where it is backed up, which teams can see it, where it is analysed and which AI models are allowed to touch it,” Olugbesan said.

That makes localisation less of an emergency hosting exercise and more of a business transformation project.

The complexity behind the migration

For organisations preparing for the deadline, the hardest part may not be moving the data itself.

“Data can be copied,” Olugbesan said. “The difficult part is moving the operating model around it without breaking the business.”

Large organisations have accumulated years of dependencies across their technology environments. Customer platforms may operate in one location, identity services in another, while backups, security monitoring, payment connections, reporting tools and vendor support sit elsewhere.

Those connections can become difficult to untangle when an organisation must draw a firm geographic boundary around its data.

Cost adds another layer of complexity. Localisation could require organisations to duplicate systems, maintain additional recovery environments, hire or retrain technical teams, and redesign applications built around global cloud infrastructure.

A rushed migration could therefore lead to unintended consequences: higher costs and reduced resilience.

Olugbesan believes organisations should instead begin with a data and dependency map, classify information by risk, and move workloads in controlled stages. Some systems may need to be localised immediately, others isolated or redesigned, while limited exceptions may be necessary where equivalent capabilities do not yet exist in Nigeria.

The broader question is whether regulation can create greater control without simply relocating existing complexity.

Can Nigeria’s infrastructure keep pace?

That question will matter as demand for local cloud and data-centre capacity grows.

Nigeria has credible data-centre operators and an expanding technology infrastructure market. But Olugbesan says it would be unrealistic to assume that every regulated workload can move locally at once while receiving the same breadth of services and maturity available in established global cloud regions.

Capacity is not simply server space.

It includes reliable power, diverse fibre routes, physical and cyber security, skilled operations teams, spare parts, and disaster recovery systems that have actually been tested. For newer workloads, it also means managed data platforms, high-performance computing and local access to GPU capacity for artificial intelligence.

If demand created by regulation grows faster than the market can add those capabilities, businesses could face higher prices, longer migration queues and excessive concentration of critical workloads in a handful of facilities.

That could weaken resilience — precisely the opposite of what data sovereignty is intended to achieve.

But the pressure also creates an opportunity. Predictable demand from banks, fintechs and government could unlock investment in data centres, connectivity, energy, cybersecurity and technical skills.

Nigeria could become more than a domestic storage market. With the right investment, it could become a regional hub for cloud and digital infrastructure in West Africa.

Where should Nigeria draw the line?

The Power Brunch will also take place against a broader policy debate over how far data localisation should go.

Olugbesan argues that regulators should distinguish between genuinely strategic information and data that can safely cross borders with appropriate safeguards.

Core financial records, payment and settlement data, national identity information, certain health records, critical infrastructure data, and credentials capable of unlocking those systems have a strong case for remaining under Nigerian jurisdiction and control.

But a blanket requirement covering every category of data could impose high costs without necessarily improving security.

Anonymised analytics, public information, lower-risk collaboration data, and certain temporary processing activities could be handled across borders, provided that encryption, contractual accountability, auditability, and clear retention limits are in place.

The key, Olugbesan argues, is classification.

Regulators need clear risk categories and equally clear rules for storage, processing, and access. Businesses need to know what data is covered, what constitutes compliance, and when exceptions can be granted.

Without that clarity, companies may struggle to plan investments and technology architectures around the rules.

From compliance to capability

Ultimately, the localisation debate is becoming a test of Nigeria’s ability to build digital capability.

Olugbesan wants a single, practical implementation framework that regulators and operators can work from, rather than broad instructions that can be interpreted differently across institutions.

Such a framework, he argues, should be technology-neutral, risk-based and supported by realistic transition periods, reporting requirements, audits and transparent exceptions.

More importantly, localisation should be used to build the domestic technology market.

Government and large regulated institutions are among Nigeria’s biggest technology buyers. Their procurement decisions could create dependable demand for Nigerian cloud services, data centres, cybersecurity, connectivity and AI infrastructure.

According to Olugbesan, localisation could become an industrial policy if done properly.

That could give Nigerian technology companies a stronger base from which to serve the wider African market and create the infrastructure needed for sovereign AI.

But sovereignty, in this sense, does not mean shutting Nigeria off from global technology.

It means having enough infrastructure, skills, security and governance to decide what must remain under Nigerian control, what can safely cross borders and how strategically important data can be converted into economic value.

That is the bigger question the September 10 Power Brunch will put before the executives shaping Nigeria’s digital economy: can the country enforce localisation while building the capability to make that localisation meaningful?

The answer will determine whether the CBN’s deadline becomes simply a compliance exercise or the beginning of a more capable Nigerian digital infrastructure ecosystem.

True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.