Nigeria’s sovereign cloud: Beyond data control to digital independence, By Fom Gyem

A credible sovereign cloud ecosystem could stimulate investment in data centres, fibre networks, renewable and conventional energy solutions, cybersecurity services and specialised technology companies. It could create demand for cloud architects, network engineers, cybersecurity professionals, data specialists and other highly skilled workers.

Nigeria’s digital economy is usually measured by the growth of fintech companies, expanding broadband connectivity, rising internet penetration, and the increasing number of citizens conducting their daily activities online. Yet beneath these visible signs of progress lies a more fundamental question that has received far less public attention: Who owns, hosts and ultimately controls the digital infrastructure on which Nigeria’s growing economy depends?

That question is increasingly moving to the centre of national technology policy.

The recent inauguration by the National Information Technology Development Agency (NITDA) of the National Sovereign Cloud Initiative Implementation Taskforce represents an important attempt to move Nigeria’s digital sovereignty conversation from policy declarations to practical execution.

For years, discussions around data sovereignty have largely focused on where Nigerian data is stored. But the issue is considerably broader. Digital sovereignty involves the country’s ability to maintain control, resilience and regulatory authority over critical digital infrastructure while remaining connected to the global technology ecosystem.

This distinction matters because modern economies increasingly depend on cloud infrastructure.

Banks process transactions through digital systems. Government agencies hold enormous volumes of citizens’ information. Hospitals, telecommunications companies, universities, security institutions and businesses rely on data centres and cloud services for their daily operations. Artificial intelligence is making computing infrastructure even more strategically important.

The cloud, therefore, is no longer simply a technology service. It is becoming part of national infrastructure.

NITDA’s sovereign cloud initiative appears to recognise this reality.

The implementation process is supported by a number of policy instruments, including the National Cloud Computing Guideline, National Cloud Technical Guideline, National Digital Infrastructure Assurance Framework and National Cloud Investment Strategy. Together, these frameworks seek to address investment, infrastructure standards, security certification and regulatory compliance.

But Nigeria’s challenge has rarely been the absence of policies.

We have produced many impressive strategies across different sectors. The more difficult task is translating them into functioning systems. This is why the creation of an implementation taskforce could prove more consequential than the policy documents themselves.

By bringing regulators, infrastructure providers, financial institutions and technology companies into the same implementation structure, NITDA is attempting to address a longstanding weakness in Nigeria’s digital-development efforts: fragmentation.

A sovereign cloud ecosystem cannot be created by a technology regulator acting alone.

It requires reliable electricity. It requires telecommunications infrastructure and fibre connectivity. It requires investment capital, cybersecurity capacity, technical skills, clear procurement rules and predictable regulation. It also requires confidence from businesses that moving workloads to locally hosted infrastructure will not compromise reliability, cost or performance.

The taskforce must therefore become more than another committee that holds meetings and produces communiqués. Its value will be determined by whether it can remove the practical bottlenecks preventing Nigeria from developing a competitive domestic cloud ecosystem.

One of the most encouraging aspects of the emerging framework is its apparent attempt to distinguish digital sovereignty from digital isolation.

Nigeria cannot achieve technological independence by simply shutting foreign technology companies out of the market. Neither should sovereignty become another name for protectionism.

The global cloud industry is dominated by companies possessing enormous infrastructure, capital, expertise and research capabilities. Nigeria still needs foreign investment, international partnerships and access to world-class technologies.

The more sensible objective is therefore not to reject foreign participation but to determine the terms under which that participation occurs.

This is where President Bola Ahmed Tinubu’s “Nigeria First” policy becomes relevant to the sovereign cloud conversation. Applied intelligently, the principle should mean building domestic capacity and protecting legitimate national interests while remaining open to international investment and expertise.

The challenge is balance.

Excessive dependence on foreign-hosted infrastructure can create vulnerabilities around data governance, jurisdiction, cybersecurity and business continuity. At the same time, forcing businesses onto inadequate local infrastructure simply to satisfy a localisation requirement could increase costs, reduce competitiveness and ultimately undermine confidence in the policy.

Sovereignty cannot be achieved by lowering standards.

If Nigerian data centres and cloud providers are expected to host sensitive government and commercial workloads, they must meet rigorous standards for uptime, redundancy, physical security, cybersecurity, disaster recovery and data protection.

A Nigerian cloud service does not become reliable merely because its servers are located within Nigeria.

Localisation without resilience is not sovereignty.

This is why the National Digital Infrastructure Assurance Framework could become particularly important. Nigeria needs a credible mechanism for determining whether infrastructure classified as critical actually meets the security and operational standards required of it.

The regulatory approach must also evolve.

Traditional regulation often depends heavily on periodic reports submitted by regulated organisations. But cloud infrastructure operates continuously, and cybersecurity threats evolve by the minute. Oversight therefore needs to become increasingly technology-driven.

Regulators should be able, within lawful boundaries, to independently verify critical compliance indicators rather than depending entirely on what operators report about themselves. Regulatory technology, automated compliance monitoring and auditable security standards can help close the gap between what exists on paper and what happens in practice.

The economic implications are equally significant.

A credible sovereign cloud ecosystem could stimulate investment in data centres, fibre networks, renewable and conventional energy solutions, cybersecurity services and specialised technology companies. It could create demand for cloud architects, network engineers, cybersecurity professionals, data specialists and other highly skilled workers.

The growth of artificial intelligence makes this opportunity even more urgent.

Countries increasingly recognise that computing capacity is becoming an economic resource. Training and deploying sophisticated AI systems requires enormous computing power. Nations that lack adequate digital infrastructure risk becoming permanent consumers of technologies developed and hosted elsewhere.

Nigeria’s ambition should therefore extend beyond simply storing Nigerian data on Nigerian soil.

The country should aspire to develop enough computing capacity to support Nigerian innovation.

Universities should be able to conduct advanced research without prohibitive access costs. Start-ups should have competitive infrastructure on which to build products. Government institutions should be able to deploy secure digital services. Nigerian AI developers should have access to computing resources that allow them to create solutions for local problems.

This is where sovereign cloud policy becomes an economic-development policy.

There are, however, questions the implementation taskforce must answer.

What incentives will attract the enormous capital required for data-centre development? How will Nigeria address the electricity demands of large-scale computing infrastructure? What standards will determine which workloads must remain within the country and which can operate across borders? How will smaller Nigerian cloud providers compete without regulatory protection becoming an excuse for poor service?

There is also the question of trust.

Citizens and businesses will need assurance that data localisation does not translate into uncontrolled government access to their information. Digital sovereignty must therefore develop alongside strong data-protection safeguards, transparent governance and respect for privacy.

A country cannot claim to protect its citizens’ data from foreign vulnerabilities while creating new domestic vulnerabilities. That is why cybersecurity, privacy, investment and sovereignty must be treated as interconnected rather than competing objectives.

The inauguration of the implementation taskforce is consequently only the beginning. Its success should eventually be measured through concrete outcomes: additional data-centre capacity, increased domestic hosting of critical workloads, improved cybersecurity certification, reduced regulatory bottlenecks, stronger Nigerian participation in the cloud industry, greater investment and demonstrable improvements in infrastructure resilience.

NITDA’s sovereign cloud initiative offers an opportunity to begin answering that question. But digital sovereignty will not be achieved through declarations, localisation directives or impressive policy documents alone.

It will be achieved when Nigeria can build critical digital infrastructure to international standards, attract investment without surrendering legitimate national interests, monitor compliance effectively, protect citizens’ privacy and develop enough indigenous expertise to operate and secure the systems on which the country’s future increasingly depends.

The cloud may sound intangible. The sovereignty required to control it must be very real.

Fom Gyem writes from Abuja and can be reached at [email protected].