Full compliance is required from 1 January 2027.

The rule itself is short: all payment transaction data generated within Nigeria must be stored and managed in Nigeria, in line with applicable Nigerian data protection law. But it reaches every licensed participant in the country’s payments industry, and it touches nearly every existing cloud, outsourcing and card scheme arrangement those firms currently rely on.

It also sits on top of an existing framework rather than replacing it. The Nigeria Data Protection Act 2023 already governs cross-border data transfers, generally permitting them only where the destination offers adequate protection or approved safeguards apply. The CBN’s circular draws a firmer line specifically around payment data, the category the regulator considers most systemically sensitive.

Institutions that have relied on those general cross-border mechanisms to justify offshore hosting of payment data now have a hard deadline to move. A standard contractual clause can still support a lawful international transfer, but it can no longer substitute for actual data residency. From January, location is the requirement, not just the paperwork around it.

For infrastructure providers, this reads as demand made mandatory. Nigeria’s electronic payment transaction volumes rose from 16.3 billion in 2021 to 38.7 billion in 2023 and are projected to exceed 60 billion this year, according to CBN figures cited by industry analysts. Every one of those transactions now needs to generate data that stays on Nigerian soil, in facilities built to handle it, with the resilience and disaster recovery capacity regulators expect from systemically important infrastructure.

Operators are already positioning for the change, though. Equinix’s $22 million LG3 facility in Lagos, the first phase of a $100 million Africa expansion plan, is due to open in the first quarter of the year. Airtel’s Nxtra subsidiary has broken ground on a 38MW hyperscale campus in Lagos, backed by $120 million in investment. Kasi Cloud, backed in part by Nigeria’s sovereign wealth fund, commissioned what it calls West Africa’s first hyperscale-ready, AI-capable campus in Lekki in May, with plans to scale to 100MW. Lagos state has set a target of tripling the city’s data centre capacity to more than 250MW by 2030.

The constraint is the same one running through the rest of Nigeria’s digital infrastructure story: power. National electricity generation has hovered between 3,000MW and 4,000MW, and energy costs for data centre operators rose by more than 64% since the start of the year. A directive that mandates local data residency does not by itself solve the grid problem operators need solved to build the capacity that residency requires.

That tension, between a regulatory deadline pulling investment toward Nigeria and a power grid that has not caught up with it, is likely to surface directly at ITW Africa and Datacloud Africa in Nairobi this September.

The event’s regulatory roundtable brings together Nigeria’s Data Protection Commission, NITDA, ATCON and ICASA to address fragmented licensing and permitting across the continent, while a dedicated workshop looks specifically at where investment is flowing across Nigeria’s digital infrastructure ecosystem ahead of the deadline. Full details are in 8 sessions to watch at ITW Africa 2026.

RELATED STORIES

Africa’s digital infrastructure ambition has a power problem

AI in Africa: driving change, but at what cost?

Equinix to invest $22m in first purpose-built West African data centre in Lagos