Data Sovereignty and the NDPA 2023: Strategies for Localizing AI Data Storage.

Abstract

Data sovereignty is a fundamental principle that ensures a state maintains authority over data generated, collected, or processed within its territory, subjecting it to domestic law and regulatory oversight. In Nigeria, this principle is enshrined in the Nigeria Data Protection Act 2023 (NDPA 2023), which governs personal data and regulates cross-border transfers. In the context of artificial intelligence (AI), data sovereignty is strategically critical, as AI systems rely on large datasets for model training and deployment. Currently, much of Nigeria’s AI-relevant data is stored or processed on foreign infrastructure, creating risks of regulatory loss, exposure to foreign legal regimes, and economic and technological exploitation by foreign entities—an emerging form of digital neocolonialism. The NDPA 2023 does not explicitly mandate localisation of AI training data, leaving a regulatory gap that may weaken Nigeria’s jurisdictional control and limit domestic technological growth. To address this, the National Assembly is urged to intervene by: 1. The National Assembly may wish to enact a law requiring that all data sets used to train AI systems about Nigerian citizens, institutions, or economic activity be stored and processed within national borders, unless adequate safeguards for cross-border transfers are approved. 2. The National Assembly, through its Senate and House committees on Communication, Science, and Technology, may wish to direct ministering of Communication, Science, and Technology to create a sovereign cloud and AI data infrastructure in Nigeria, accompanied by standards for secure storage, processing, and auditing of AI datasets. 3. The National Assembly to the Senate and House Committee Communication, Science and technology may wish to introduce fiscal, technical, and policy incentives for Nigerian companies and research institutions to adopt localised data storage and AI development practices. 4. The Senate, House Committee, and the Committee on Justice and Human Rights) may consider reviewing and recommending legislative amendments to the NDPA 2023 to explicitly include AI data localisation requirements, establish penalties for non compliance, and ensure that Nigerian courts and regulatory bodies have jurisdiction to enforce these provisions.