Choosing a data centre in Nigeria: what to ask
Nigeria has 18 commercial data centres and 50–56 MW of operational capacity. A practical question list for selecting colocation that will hold payment data under the CBN directive.
For most banks and payment providers, meeting the CBN directive's 1 January 2027 deadline means colocation in a commercial Nigerian data centre rather than building a facility. Nigeria has around 26 data centre facilities, 18 of them commercial, with 50–56 MW of operational capacity and more under construction. Operators include Open Access Data Centres (OADC), Rack Centre, Kasi Cloud, Galaxy Backbone and Equinix. Capacity exists. The question is which facility, on which terms, for a workload that a regulator will inspect. This article is the question list we use.
Start with what the directive needs from the facility
The directive requires payment data, backups, IAM, keys and audit logs to be stored and managed in Nigeria, prohibits foreign cloud dependency, and requires that your institution can facilitate regulatory inspection and audit its suppliers. Translated into facility requirements:
- Physical location in Nigeria, obviously, but also all operational control of the facility from Nigeria
- Contractual localisation and audit clauses the operator will actually sign
- Physical access for CBN inspectors on reasonable notice
- Enough space, power and connectivity for a two-site topology, because DR replicas cannot stay abroad
Everything else on the list is ordinary data centre due diligence, sharpened by the deadline.
The question list
Location and resilience
- Which city, and which site within it? Lagos concentrates most capacity; a second site in Abuja or elsewhere gives geographic separation for DR.
- What is the distance between your two candidate sites, and what is the round-trip latency on the operator's own fibre? Synchronous replication needs low single-digit milliseconds; asynchronous tolerates more.
- Flood risk, grid substation diversity, and the site's history of unplanned outages in the last three years.
Power
- Utility feeds: how many, from which substations, and what is the grid availability actually experienced?
- Generator capacity, fuel storage in hours at full load, and refuelling contracts. In the Nigerian context this is the question that matters most.
- UPS topology (N+1, 2N) and battery runtime.
- Power available per rack, and whether high-density racks for storage and GPU nodes are supported.
- Tier certification (Uptime Institute Tier III or equivalent) and whether it is design, constructed-facility, or operational sustainability certification.
Connectivity
- Carrier neutrality: how many carriers are present, and can you bring your own?
- Diverse fibre entry points into the building.
- Direct connectivity to the other operator sites you may use for DR, and to the Nigerian internet exchange.
- Cross-connect pricing and lead times.
Security and compliance
- Certifications held: ISO 27001, PCI DSS attestation for the facility, SOC 2 reports if available. Ask for the certificates and the scope, not the logo on the website.
- Physical access controls: mantraps, biometrics, escorted access, CCTV retention.
- Whether cages or private suites are available for regulated workloads, and whether a dedicated cage can be inspected without exposing other tenants.
- Incident history and the operator's breach notification commitments.
Operations and control
- Where is the facility's building management, monitoring and ticketing operated from? If the NOC is abroad, ask whether that creates a foreign dependency for your operations.
- Remote hands: hours, response times, and the skills of the staff.
- Change management and maintenance windows.
Commercial and contractual
- Will the operator sign data localisation and regulatory audit clauses? Ask on the first call; it saves weeks.
- Contract term, exit provisions and equipment removal on termination.
- Power pricing model (metered vs allocated) and escalation.
- Lead time from signature to a live rack, including cross-connects.
A comparison template
Use one row per candidate facility. Score each cell 0–2 and add a weight for the items that matter most to you.
| Criterion | Weight | Site A | Site B | Site C |
|---|---|---|---|---|
| Nigerian operational control | 3 | |||
| Localisation and audit clauses | 3 | |||
| Power redundancy and fuel autonomy | 3 | |||
| Tier III or equivalent certification | 2 | |||
| Carrier neutrality and diverse fibre | 2 | |||
| Second site within workable DR latency | 2 | |||
| ISO 27001 / PCI DSS scope covers your space | 2 | |||
| Cage or suite available | 1 | |||
| Lead time to live rack | 2 | |||
| Remote hands quality | 1 | |||
| Commercial terms and exit | 1 |
Colocation versus building your own
Building a facility is not realistic for the January 2027 deadline. Some large banks already operate their own data centres and can use them; for everyone else, the choice is colocation now, with an option to consolidate later. A useful hybrid is colocation for the first site and an existing corporate facility as the second site for DR, provided the corporate facility meets the power and security bar.
What the facility does not solve
A data centre contract gives you floor space, power and connectivity. It does not give you a platform. The sector's own operators say the constraint is not space but the absence of complete local cloud platforms and of engineers who have built and operated private cloud at scale. Once the racks are live, you still need virtualisation, Kubernetes, storage, key management, identity, observability, backup and the operational discipline to run them. That is a separate decision, and it is the one that determines whether the migration finishes on time. The readiness assessment covers both the facility and the platform questions.
Timing
Facility selection should complete within the first three to four weeks of the programme, because hardware ordering and cross-connect lead times start from signature. Run the question list in parallel with the data map, shortlist to two facilities in week two, visit both in week three, and sign in week four. Our timeline article, How long does a payments data migration really take?, shows where this sits on the critical path.
This is not legal advice. This article provides a technical due-diligence checklist for planning purposes. Consult your legal and compliance advisers on how the directive applies to your institution and on facility contracts.
NuxFamily works with Nigerian colocation operators and builds the private cloud platform that runs inside their facilities, from rack design through to 24×7 enterprise support. If you want help evaluating facilities or designing what goes in them, see our CBN data localisation resource or contact us.
