NDPC backs CBN’s local data policy, ays Nigeria can host payment data

Data protection regulator says a joint working group with the Central Bank of Nigeria is advancing the payment-data localisation policy, as Nigeria’s data privacy economy reportedly surpasses $12 billion.

The Nigeria Data Protection Commission (NDPC) has disclosed that it was involved in the policy by the Central Bank of Nigeria (CBN) requiring financial institutions and payment service providers to domicile customer payment transaction data within the country by January 1, 2027.

The policy, which covers commercial banks, merchant banks, microfinance institutions, mobile money operators, payment service providers and fintech companies, is aimed at ensuring that payment transaction records and related data are hosted within Nigeria.

The Chief Executive Officer and National Commissioner of the NDPC, Vincent Olatunji, disclosed this in response to a question from IT Edge News.Africa, explaining that a joint working group comprising officials from both institutions is working to ensure the policy’s objectives are achieved.

Olatunji said the collaboration reflects his belief that regulatory agencies must work together to deliver results.

The CBN’s Payments System Supervision Department issued circular PSS/DIR/PUB/CIR/001/004 on June 15, 2026, requiring payment transaction records, processing logs and archival hosting to be domiciled on certified local data centres or localised cloud infrastructure within Nigeria.

Olatunji said the Nigeria Data Protection Act (NDPA) 2023 provides a framework for classifying data and determining which categories should remain within Nigeria and which may be transferred across borders.

The Act, signed into law on June 12, 2023, is Nigeria’s primary legislation governing personal data protection. It requires personal data to be processed and retained fairly, lawfully and transparently, for specific and legitimate purposes.

According to the NDPC chief, data classification is central to determining which information must be processed locally, particularly where national sovereignty and security considerations apply.

“What we have done in our Data Protection Law is to classify data; what categories of data must remain local? What categories of data can we share?” he said.

He explained that while Nigerians may interact with organisations in the United States, Asia and Europe, certain categories of data must remain within the country to ensure that Nigeria retains control over critical information.

“So, we are working with CBN regarding this. The data that must remain local depends on the kind of classification you are looking at. Security data must remain local,” Olatunji said.

He added that the classification of financial data would depend on its nature and the applicable requirements.

“When someone says my financial data must remain local, it depends on the kind of financial data you are talking about. So, it varies. Data classification is very key; and that is why we are encouraging it,” he said.

The National Commissioner maintained that Nigeria has the infrastructure required to process and store data within its borders, suggesting that major organisations operating in the country could rely on domestic facilities rather than foreign-based hyperscale providers for data hosting.

According to Olatunji, Nigeria has more than 25 data centres, many of which are underutilised.

“We have over 25 data centres in Nigeria, most of which are actually underutilised. Nigeria has the capacity to host what can be regarded as our local data. There may be challenges with infrastructure, most especially power, but the government is finding ways around these issues,” he said.

His remarks highlight the role of local data centres and cloud infrastructure in supporting Nigeria’s data sovereignty ambitions, particularly as the financial sector prepares to comply with the CBN’s localisation deadline.

The policy is also expected to create opportunities for domestic data centre operators and cloud service providers to support financial institutions seeking compliant local hosting arrangements.

Olatunji made the disclosures on the sidelines of the eighth edition of the Data Protection Africa Summit (DPAS) 2026 in Lagos, where he outlined the NDPC’s achievements and called on other African countries to learn from Nigeria’s regulatory experience.

In his keynote address, he said the Commission had helped create a data privacy economy worth more than $12 billion within three years, largely through its public-private partnership (PPP) model.

“From our own experience, because of the PPP model that we adopted, we have now created an economy around data privacy which is worth over $12 billion within three years. And I’m not sure of any law that has been able to achieve that in Nigeria,” he said.

The NDPC’s PPP framework involves licensed private-sector professionals and experts undertaking compliance-related activities on behalf of the government.

Olatunji said the model had also created more than 27,000 jobs for Nigerians within the same period, as the Commission relied on private-sector partners to implement the Nigeria Data Protection Act.

“Through this process, we can confidently say we are the best in Africa. We are the first in terms of compliance, registration, and impact on the economy. This is why the summit was brought here for African countries to learn from our experience and for us to share ideas as well,” he said.

Olatunji explained that the NDPC adopted the PPP model because of the scale of Nigeria’s data protection responsibilities.

He cited the country’s population of more than 230 million people, 36 states, 774 local government areas and over 500,000 data controllers and processors as factors requiring a broad-based approach to implementation and compliance.

The Commissioner argued that relying solely on government personnel would have limited the Commission’s ability to achieve its current level of reach.

“And I keep saying, with the traction that we have achieved in Nigeria, this model has really contributed. If we were to just sit down as a government organisation, say we are enforcing a law, we are implementing, there is no way we would get to where we are today,” he said.

The NDPC’s approach, he added, provides an example of how regulatory institutions can work with private-sector professionals to expand compliance capacity and develop a wider data protection ecosystem.

The Executive Director of the Africa Data Rights Hub (ADRH), Ms Teki Akuetteh, said data protection should be treated not merely as a legal issue but as a fundamental right.

“Data protection is not just a legal subject but a fundamental right. Every member of society has the right to have their information protected,” she said.

Akuetteh stressed the need for society to respect and protect personal information and ensure that harms resulting from data misuse can be mitigated.

The ADRH founder explained that the Data Protection Africa Summit is one of the annual events held in different African countries to raise awareness and build capacity on data protection issues.

She said this year’s theme, “Strengthening Data Protection Through Strategic Partnerships,” was chosen in response to the need to harmonise the diverse data protection policies and practices across the continent.

Akuetteh welcomed the progress made by the NDPC since the enactment of Nigeria’s data protection law, while cautioning that rapid technological change continues to create new challenges.

She said African countries must develop and strengthen their data protection frameworks consistently, with opportunities for stakeholders from different sectors to share experiences and identify what works.

Akuetteh also called for greater harmonisation of data protection laws across Africa, arguing that differences in national regulatory frameworks can complicate cross-border data transfers and financial transactions.

She cited the differences between the data protection laws of Nigeria and Ghana as an example of how regulatory variations can affect the movement of data and, in some cases, money between countries.

“Across Africa, there is still the challenge of harmonisation of data protection laws,” she said.

Akuetteh acknowledged the role of the African Union and continental initiatives, including the African Continental Free Trade Area (AfCFTA), digital trade frameworks and related protocols, in advancing cooperation.

She said that while there are similarities among data protection laws across African countries, closer collaboration among regulators is necessary to facilitate cross-border data transfers and build trust.

According to her, harmonisation does not necessarily require a single law for all countries, but rather a common approach that allows regulators to interpret and implement their respective frameworks in ways that support cooperation.

“After all, even when a country has the same laws, there are different individuals and regulators that implement the laws. So, one person’s interpretation may differ,” she said.

Akuetteh maintained that strategic partnerships among regulators would help build trust and establish simpler, more consistent approaches to cross-border data protection.

Instagram Facebook Twitter LinkedIn Editorial EDITORIAL – The $1 trillion imperative: Why Nigeria’s digital economy needs law, not just innovation July 21, 2026 Nigeria’s Digital Economy Outlook Q2 2026: Regulation, Resilience and the Race to a $1 Trillion Economy July 16, 2026 Upcoming Events Event Nigeria needs trade secrets law to protect AI innovations, legal expert warns October 20, 2026 Event Web3 x AI Fusion Singapore August 14, 2026 Event Connected Banking Summit 2026 opens in Ethiopia, driving digital banking innovation across Africa August 6, 2026

Enter your email to receive our newsletter.

Enter your email to receive our newsletter.

Get the edge in technology reporting straight to your email, once per week. We don’t spam.