Nigeria NITDA National Cloud Technical Guideline 2026 10.4.IV.c: Use an out-of-country tertiary backup only for Level 1 and 2 data, under the stated conditions and with NITDA's prior written approval

What does 10.4.IV.c require?

A tertiary backup outside Nigeria is permitted only for Level 1 and Level 2 data and only when the FPI gives NITDA a formal justification showing in-country sites cannot meet specific heightened resilience needs; the transfer complies strictly with the NDPA 2023, through an NDPC adequacy decision for the destination or an approved protective instrument (standard contractual clauses, for instance); and all transferred and stored data is encrypted in transit and at rest to the guideline's standards with the FPI or its SI keeping full control of keys generated and managed within Nigeria. The FPI first obtains NITDA's explicit written approval, backed by a documented risk assessment and a justification, following the authorisation route the national cloud computing guideline and the sovereign cloud policy lay down; such arrangements stay limited to Level 1 workloads and NITDA-approved Level 2 exceptions.