In a significant development, largely unprecedented in Nigeria, the Central Bank of Nigeria ("CBN") issued a Circular titled Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigerian Payments System on 15 June 2026 ("Circular"). Through the Circular, the CBN directed that all financial institutions and participants facilitating payment transactions within Nigeria must ensure that payment transaction data generated within the country is stored and managed in Nigeria in accordance with applicable Nigerian data protection laws and regulations. Compliance with this requirement becomes mandatory from 1 January 2027. The discourse below centres around the impact of the requirement on Nigeria’s data protection regulatory landscape.
The issuance of the Circular marks an important milestone in the evolution of Nigeria's approach to data governance and digital sovereignty. It follows the enactment of the Nigeria Data Protection Act 2023 ("NDPA"), which represented a major step forward in establishing a comprehensive framework for the protection and governance of personal data. Although the NDPA does not impose a blanket requirement that all personal data generated within Nigeria must be stored domestically, it establishes a robust accountability regime governing the lawful processing of personal data and the implementation of appropriate safeguards for cross-border transfers. In doing so, it reflects the broader policy objective of ensuring that the personal data of Nigerians remains adequately protected irrespective of where such data is processed.
Since the enactment of the NDPA, Nigeria's regulatory landscape has continued to evolve. In the exercise of its supervisory mandate over the payment ecosystem, this move by the CBN is a notable starting point for the inevitable shift from traditional privacy regulation towards a broader emphasis on data localisation, regulatory oversight, and the protection of strategically important digital infrastructure.
Although the Circular does not expressly identify the data protection laws contemplated by this requirement, the reference is properly understood to include the NDPA, the Nigeria Data Protection Commission's General Application and Implementation Directive ("GAID") 2025, and any subsidiary regulations, standards, or guidance issued by the Commission. These requirements also sit alongside the Cybercrimes (Prohibition, Prevention, etc.) Act and the CBN's own cybersecurity and operational resilience frameworks.
The Circular is a clear manifestation of the principle of data sovereignty within Nigeria's financial services sector. It reflects a growing regulatory preference for ensuring that strategically important financial and transactional data remain within Nigeria and are readily accessible to domestic regulators in the exercise of their supervisory functions.
Importantly, the CBN's localisation requirement should not be viewed in isolation. Rather, it complements the accountability framework established under the NDPA and the GAID 2025. Whilst those instruments primarily regulate the lawful processing, security, and international transfer of personal data, the CBN's directive introduces an additional layer of sector-specific regulation aimed at strengthening regulatory oversight, enhancing cyber resilience, and preserving national digital sovereignty.
Similar developments have emerged across jurisdictionswhere governments increasingly seek to ensure that strategically important data assets remain subject to domestic oversight and control, such as India (the RBI's 2018 payment-data storage directive), China (the Cybersecurity Law's requirements for critical information infrastructure operators), Saudi Arabia (SAMA's Cloud Computing Framework for banks), Indonesia (applying localisation to public-sector systems), and parts of the European Union. The Circular sits within this policy trend as a milestone for Nigeria.
Perhaps one of the most significant implications of the Circular lies in its potential to accelerate investment in Nigeria's digital infrastructure ecosystem. By requiring payment transaction data generated within Nigeria to be stored and managed domestically, the Circular creates a strong commercial incentive for the expansion of local data hosting capabilities. The resulting increase in demand for in-country storage and processing capacity is likely to stimulate investment in data centres, cloud infrastructure, cybersecurity services, disaster recovery facilities, and artificial intelligence capabilities.
For local data centre operators and investors, the Circular presents a considerable opportunity. Existing operators are likely to benefit from increased demand from banks, fintech companies, payment service providers, switching companies, and other regulated entities seeking to comply with the localisation requirements. At the same time, the directive may encourage the development of new Tier III and Tier IV facilities and attract private equity, infrastructure funds, sovereign wealth investors, and strategic partnerships into Nigeria's rapidly expanding digital infrastructure market.
Indeed, the Circular may prove to be a catalyst for the emergence of a thriving domestic cloud and data centre industry. In much the same way that previous reforms stimulated growth in telecommunications and financial technology, the localisation requirement has the potential to create an entirely new class of infrastructure investment opportunities. Developers, technology companies, energy providers, telecommunications operators, and institutional investors may all find themselves well positioned to participate in what could become one of the most significant growth areas within Nigeria's digital economy.
Conversely, international cloud providers whose infrastructure is located entirely outside Nigeria may face increasing pressure to adapt their operating models. Existing outsourcing arrangements and cloud service agreements may need to be restructured to accommodate local residency requirements. This may encourage global providers to establish local availability zones, enter into partnerships with Nigerian data centre operators, or develop sovereign cloud solutions capable of satisfying Nigerian regulatory expectations.
From a corporate governance perspective, the implications of these developments extend far beyond technology and compliance functions. Financial institutions and payment service providers will increasingly be required to align their information technology architecture, outsourcing arrangements, and third-party vendor relationships with these evolving localisation requirements. This will inevitably require closer collaboration among Boards, management, data protection officers, informationsecurity teams, compliance functions, and Company Secretaries.
Ultimately, the convergence of the NDPA, the GAID 2025, and the CBN's localisation requirements reflects Nigeria’s growing alignment with global efforts to strengthen control over critical data assets and protect national digital infrastructure. More importantly, it underscores the growing recognition that data governance is no longer merely an information technology issue. Rather, it has become a strategic concern with profound implications for regulatory compliance, operational resilience, cybersecurity, risk management, investment, and long-term economic development. For Nigeria, the Circular may well mark the beginning of a new phase in which digital infrastructure becomes as strategically important as roads, ports, and power, and where local data centres emerge as critical assets in supporting the country's ambitions as a leading digital economy.
References
- Nigerian Data Protection Act 2023
- General Application and Implementation Directive (GAID) 2025
- CBN Circular dated 15th June 2026 and titled “Introduction of Market Structure
Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and
Systemic Oversight Measures in the Nigerian Payments System”.
Originally published 10 July 2026.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
