Nigeria Builds Its Own Cloud to Keep Its Data at Home

Key points

• Nigeria established the Joint Technical Committee of the National Sovereign Cloud Initiative on 20 August 2025, marking the country's first formal step toward a homegrown national cloud.
• The initiative targets $750 million in infrastructure investment over two years.
• Nigeria is Africa's third-largest economy, with a GDP estimated at $377 billion by the International Monetary Fund as of April 2026.
• Government agencies are the second-most targeted type of organisation in Africa, behind the education sector, according to Check Point Software Technologies' August 2026 threat report.
• Data stored locally isn't automatically safer: ongoing testing and real consequences for failure matter more than location alone.

Nigeria is building its own national cloud, meaning a network of computer servers and data storage owned and operated inside the country, rather than renting that capacity from American or European technology companies. The government took its first formal step on 20 August, setting up an oversight body called the Joint Technical Committee of the National Sovereign Cloud Initiative, or JTC-NSCI.

Why is Nigeria doing this now?

Two pressures pushed the decision. First, American law can, under certain circumstances, give US authorities access to data stored on US-owned servers anywhere in the world, even if those servers sit on foreign soil. Second, US export restrictions on powerful AI chips and software have left many countries scrambling to build their own technology base before the door closes further.

Kashifu Inuwa, head of Nigeria's National Information Technology Development Agency and co-chairman of the new committee, put it plainly: "We should have control over our data. We should have control over our algorithms and our AI, and all our transactions."

Nigeria isn't alone. The United Arab Emirates is building a 5-gigawatt AI facility managed by domestic provider G42. Japan has partnered with Microsoft on local data centres. The United Kingdom pushed for homegrown AI services after Washington briefly restricted exports of Anthropic's most capable models, and the pattern has since spread across multiple continents.

What attacks has Nigeria already suffered?

The country faces serious threats its government has felt directly. Inuwa described the damage in a 4 August statement: government websites defaced and quietly redirected to gambling sites, ransomware (malicious software that locks files until a payment is made) forcing government portals offline, and repeated breaches leading to theft of citizens' personal data.

Africa ranks third globally in weekly cyberattacks per organisation, behind Latin America and Asia Pacific. Nigeria has frequently topped the continent's most-attacked list, though Angola edged ahead in both June and July 2026, according to Check Point's August 2026 threat landscape report.

Does storing data locally make it safer?

Not automatically. Paul Barbosa, vice president of cloud security at Check Point, warns that location alone isn't a security plan: "Where I get cautious is when residency becomes a proxy for security, and certification becomes a one-time audit rather than an ongoing discipline. Location plus a badge is not a security architecture."

What gives Nigeria's plan credibility, according to Check Point's Ian Van Rensburg, is that it pairs data residency with technical certification requirements and procurement accountability, treating the whole thing as a national project rather than a box-ticking IT exercise. Lior Atar, chief information security officer at sovereign AI provider Dream, agrees but adds a firm condition: certifications must require providers to prove their defences work continuously through live monitoring rather than a single annual check.

For ordinary Nigerians, the practical upside of success is straightforward. Government databases holding tax records and identity documents would become harder for foreign governments or criminal groups to access or hold for ransom. The risk, as Atar notes, is that a defined national perimeter also tells attackers exactly where to aim. "Defending it becomes a national mission," he says.

The transition period is where things get dangerous. The JTC-NSCI's work is new enough that criminals will probe it hard. Australia's experience is instructive: we reported on 20 August how Airlock Digital cleared an independent government security assessment at PROTECTED level, precisely because continuous verification was built into the process from the start. Nigeria's initiative borrows the same logic; whether its committees enforce it with the same rigour is the question worth watching.

Common questions

Does this affect Nigerian citizens directly?

If the initiative delivers on its goals, citizens' data held by government agencies should be stored inside Nigeria under Nigerian law, reducing the chance it can be accessed by foreign governments or seized in a ransomware attack targeting a foreign cloud provider.

What should people watch for while this is being built?

The transition period is the riskiest phase. Citizens who receive unexpected messages claiming to be from a Nigerian government agency and asking for personal information should treat them with caution, as criminals often exploit moments of infrastructure change to run phishing scams, where fake emails or texts trick people into handing over passwords or account details.