Mozambique And Nigeria Take Opposite Roads On Cloud Rules

For years, the question of where an African company’s data should reside was largely settled by price and convenience. The answer was often a hyperscaler region outside the country, with little regulatory scrutiny. That is changing, but Mozambique and Nigeria are taking different approaches.

Mozambique has put its position into law. Two decrees, one on cloud computing (No. 72/2025) and another on data centres (No. 71/2025), establish licensing, security and service-continuity requirements for providers. They also require primary data centres to be located within the country. Secondary sites, including backup and disaster-recovery facilities, can be located elsewhere, provided they meet specified continuity and recovery standards.

The obligations extend beyond service providers. Organisations purchasing cloud services are expected to verify that the services and data centres they rely on comply with the rules. Those operating in essential sectors face stricter requirements covering data-centre location, infrastructure classification and security.

The decrees also introduce obligations covering record-keeping, contractual terms and regulatory oversight. However, reporting published in mid-October did not establish when the rules would take effect or what penalties would apply. Organisations potentially affected should consult the decree texts before making compliance decisions.

Nigeria has taken a different approach. Its National Digital Cloud Policy, announced by the communications ministry in August, does not require all data to remain within the country. Instead, it applies a risk-based framework that considers the sector and sensitivity of the information involved, with stronger protections for data in areas such as financial services and healthcare.

The stated aim is to avoid imposing restrictions that could discourage investment while ensuring sensitive information receives appropriate protection.

The policy has a second ambition: to turn Nigeria from a cloud services customer into a regional provider. The government plans to coordinate the migration of federal agencies to cloud services and use that demand to attract investment from providers. An earlier report put the investment target at $750 million over 24 months.

Data sovereignty gains ground

Pressure for greater control over African data is also building elsewhere. ITWeb Africa’s headlines on November 6 reported calls from African judicial representatives for stronger control over data within the continent.

Other headlines that day pointed to Kenya considering tougher social media rules and Uganda weighing SIM tracking measures for children. However, the available reports did not provide enough detail to establish the scope or implications of those proposals.

For CIOs, the practical implication is that there is no single African approach to data sovereignty. Mozambique ties compliance to the location of the primary data centre. Nigeria links it to the nature and sensitivity of the data.

A company operating in both markets could therefore face different compliance requirements under the same cloud services agreement. A workload permitted to run in an offshore cloud region under Nigeria’s risk-based framework may face different restrictions under Mozambique’s localisation requirements.

The starting point for organisations should be a register of their workloads, identifying the information each holds, its sensitivity, the sectors it supports and where it is hosted.

That inventory can help CIOs assess which workloads may need to move, which require additional safeguards and where contracts with cloud providers need reviewing. As more African governments introduce data sovereignty rules, knowing where information resides will become a core part of technology governance.