Moving Data Beyond Nigeria’s Borders

A fine that made the rule concrete

In July 2025, the Nigeria Data Protection Commission (NDPC) fined MultiChoice Nigeria ₦766.2 million. Among the reasons: unlawful cross-border transfers of subscriber data, without adequate safeguards or consent. BusinessDay breaks down this fine and the regulator's other sanctions in its review of NDPC enforcement.

That decision changed the conversation. Moving personal data out of Nigeria is no longer a compliance detail for lawyers. It is a risk that sits on the balance sheet, and it concerns any company whose servers, backups or software tools sit outside the country.

The rule: data leaves only with protection

The Nigeria Data Protection Act (NDPA) was signed into law on 12 June 2023. KPMG explains what the new law created, including its regulator, in a note published that same month. It applies to any organisation that processes the data of people in Nigeria, including companies based abroad.

Its section 41 sets the principle. Personal data can only leave Nigeria if the recipient is subject to an adequate level of protection, or if one of the exceptions in section 43 applies. The company must be able to show which basis it relied on for each transfer.

In practice, the question goes beyond sending files abroad. When a company hosts its customer database on a server outside Nigeria, or uses a software tool that stores data abroad, the data leaves the country. The transfer rules fit in a few pages: read sections 41 to 43 in the full text of the Act.

What "adequate protection" means

Section 42 of the Act defines adequate protection as protection substantially similar to the Nigerian law. The NDPC looks at several points in the destination country: whether people have enforceable rights, whether public authorities can access the data, and whether an effective data protection law and an independent regulator exist.

The NDPC's General Application and Implementation Directive (GAID), released in March 2025, details the method. Its article 45 refers to a schedule (Schedule 5) that lists the criteria for assessing a country. The Lagos firm The Trusted Advisors goes through each criterion and the gaps companies still face.

One point matters for companies: the absence of a decision does not mean a country is adequate. As of June 2026, the NDPC had not yet issued its approved cross-border transfer instrument, the same firm notes. Companies must therefore assess the destination country themselves, and document it.

Without adequacy: six exceptions

When the destination does not offer adequate protection, section 43 allows a transfer in six cases only:

• the person has consented, after being informed of the risks;
• the transfer is necessary to perform a contract with that person;
• it is for the person's sole benefit, and consent is impractical to obtain;
• it serves an important public interest;
• it is needed to establish, exercise or defend a legal claim;
• it protects the vital interests of a person unable to consent.

These are exceptions, not a routine basis. Hosting a whole customer database abroad on the strength of consent ticked at sign-up is fragile: the person must have been told about the risks.

Who is most exposed

The Act treats some organisations as "data controllers or processors of major importance", because of the volume or value of the data they process. They must register with the NDPC. By January 2026, 38,677 of them had done so, according to BusinessDay.

For them, the maximum fine is ₦10 million or 2% of the previous year's annual gross revenue, whichever is higher (section 48). For other organisations, it is ₦2 million or 2% of revenue. The NDPC weighs the seriousness and duration of the breach, the number of people affected and the company's cooperation.

Banks and fintechs: a stricter rule from 1 January 2027

The financial sector faces a second rule, beyond the NDPA. A circular from the Central Bank of Nigeria (CBN) requires that "payments transaction data generated within Nigeria are stored and managed in Nigeria", BusinessDay reports. The deadline is 1 January 2027. See who the circular covers and the other rules it sets for payment operators.

It covers banks, microfinance banks, mobile money operators, switching companies and payment service providers. For them, the question is no longer how to justify a transfer, but where to host locally.

In parallel, the National Information Technology Development Agency (NITDA) has announced a public register of certified cloud providers, planned for October 2026. BusinessDay explains how the register will work and what it could change for banks choosing a cloud provider. As of 16 October 2026, we have not found confirmation that it has been published.

What to check now

1. Map where your data lives. Main servers, backups, email, CRM, accounting software: list the country where each one stores data.
2. Write down the legal basis for each transfer. Adequate protection in the destination country, or one of the six exceptions. Without this record, you cannot answer an NDPC request.
3. Read your hosting contracts. Check where your provider stores your data and whether it can move it without your agreement.
4. If you process payments, plan local hosting now. Migrating a database in December is far riskier than migrating it in the first quarter.
5. Check whether you are of "major importance". If so, registration and annual compliance audits apply.

What companies are still waiting for

The NDPC has the tools to sanction. What companies are waiting for is its first approved transfer instrument. Will it arrive before the CBN deadline on 1 January 2027?