National Digital Cloud Policy and NITDA sovereign cloud instruments set rules for government hosting

Image: BalticServers.com / Wikimedia Commons, CC BY-SA 3.0

Government will aggregate cloud demand from registered providers; NITDA plans a regulatory platform to onboard and certify providers by October 2026.

Jurisdiction NigeriaPractice Competition and Regulatory, Technology, Media and TelecomsSector Public Sector, Technology

The Federal Ministry of Communications, Innovation and Digital Economy unveiled the National Digital Cloud Policy on 17 August 2026, targeting US$250m of private investment in cloud and data centre infrastructure within 12 months and US$750m within 24 months. Earlier in August, NITDA signed three instruments under the National Sovereign Cloud Initiative: the National Cloud Computing Guideline, the National Cloud Technical Guideline and the National Digital Infrastructure Assurance Framework, and presented a National Cloud Investment Strategy.

The policy

The policy has four priorities: investment and market development; regional digital services exports; government cloud transformation; and digital sovereignty and security. Under a whole-of-government aggregation framework, the government will aggregate demand for cloud capacity from multiple registered providers and offer shared government cloud services, aiming to reduce duplicated spending and create anchor demand for private investment.

NITDA’s framework

NITDA says the instruments provide regulatory certainty, technical standards and assurance for cloud adoption and infrastructure. It has established a Sovereign Cloud Governance Committee and plans to operationalise a national digital regulatory platform by October 2026 for the onboarding, assessment, certification and regulation of cloud and digital infrastructure providers operating in Nigeria.

Legal implications

Cloud and data centre providers seeking government work will need NITDA certification and registration. Government data classification will determine what can be hosted offshore or by global hyperscalers. The rules interact with the Nigeria Data Protection Act, the Federal Government’s data protection circular for MDAs, and the CBN’s data localisation directive for payment data. Competition questions arise from demand aggregation: Streamsowers & Köhn has discussed UK experience in making cloud markets contestable, including egress fees and interoperability. Providers should review certification criteria when published, and vendors to government should expect cloud procurement to be channelled through the aggregation framework.

Contracts with government agencies should address data location, exit and audit rights from the outset.