Data Center Hosting Agreement (Nigeria)

A Data Center Hosting Agreement in Nigeria governs the relationship between the parties by fixing what each must do.

Data center hosting in Nigeria operates within a multi-regulatory framework. The Nigerian Communications Commission (NCC) licenses internet exchange points, internet service providers, and infrastructure providers under the Nigerian Communications Act 2003 and NCC Regulations. The National Information Technology Development Agency (NITDA), which administered the Nigeria Data Protection Regulation (NDPR) 2019, has been succeeded by the Nigeria Data Protection Commission (NDPC) established under the Nigeria Data Protection Act 2023 (NDPA), which now has primary jurisdiction over data protection compliance for data center operators processing personal data of Nigerian residents.

Data sovereignty and localisation requirements are a critical consideration in Nigerian data center agreements. The NDPA 2023, Section 43, restricts the transfer of personal data to countries outside Nigeria to those countries with adequate data protection laws, or where the data controller has implemented appropriate safeguards. The Central Bank of Nigeria (CBN) Consumer Data Protection Regulations and CBN IT Standards impose data localisation requirements on financial sector data — requiring that transaction data and customer data of Nigerian financial institutions be stored primarily within Nigeria. The National Health Act 2014 imposes similar data localisation requirements for health records under the National Health Information System.

Nigeria's data center market includes operators such as MainOne (now Equinix), Rack Centre, MTN Data Centers, CSquared Nigeria, and Medallion Communications, operating tier-certified facilities in Lagos, Abuja, and Port Harcourt. The Telecommunications and Digital Infrastructure Sharing Framework regulates shared infrastructure and colocation services among operators.

The Cybercrimes (Prohibition, Prevention, Etc.) Act 2015 imposes obligations on Critical National Information Infrastructure operators and applies to data centers designated as CNII. Data center operators and their clients must comply with the Cybercrime Act's requirements for security, incident reporting, and lawful access to stored data by authorised agencies.

The legal framework governing the Data Center Hosting Agreement (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a Data Center Hosting Agreement (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.

A Nigeria Data Center Hosting Agreement is needed whenever an organisation places its IT equipment, data, or applications in a third-party data center facility in Nigeria, or when a Nigerian data center operator provides services to a client.

Financial institutions regulated by the CBN — including banks, payment service providers, insurance companies, and FinTech companies — that outsource their IT infrastructure to a Nigerian data center require a formal hosting agreement. The CBN IT Standards and the CBN Risk-Based Cybersecurity Assessment Programme require financial institutions to maintain formal contracts with IT service providers, including SLAs, security standards, audit rights, and incident response provisions.

Government agencies and parastatals migrating to cloud or colocation data center services require a formal agreement compliant with the National Cloud Computing Policy 2019 issued by the Federal Ministry of Communications and Digital Economy, which designates government cloud as a category requiring specific data sovereignty protections.

Telecommunication operators and internet service providers that colocate network equipment — routers, servers, network appliances — at carrier-neutral data centers or internet exchange points require a colocation agreement covering physical security, power, connectivity, and access controls.

Healthtech and medtech companies storing patient health records — subject to data localisation under the National Health Act 2014 and NDPA 2023 — require a hosting agreement with a Nigeria-based data center that includes specific health data protection provisions.

E-commerce platforms, SaaS providers, and digital businesses with Nigerian user bases and NDPA 2023 obligations for Nigerian resident personal data require a hosting agreement with a Nigeria-located data center to satisfy data localisation requirements and demonstrate NDPC compliance.

Parties in Nigeria should prepare a Data Center Hosting Agreement (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A Nigeria Data Center Hosting Agreement must contain the following provisions to protect both parties and confirm regulatory compliance.

Service description and scope: detailed specification of colocation space (rack units, cage, or suite), power supply (primary and redundant UPS, rated kVA), cooling provision, and network connectivity (bandwidth, IP addresses, and peering arrangements). The specification must align with the agreed Tier classification (Tier I through IV under the Uptime Institute standard, commonly referenced in Nigerian data center contracts).

Service Level Agreement (SLA): specific, measurable performance commitments including facility uptime guarantee (typically 99.9% to 99.999% depending on Tier level), maximum planned maintenance windows, power delivery standards (including generator backup and fuel supply obligations), and cooling standards. The SLA must specify service credits payable for downtime below the guaranteed level.

Data protection obligations: the agreement must address the Host's obligations as a data processor under NDPA 2023 (where the Host processes personal data on behalf of the Client), including processing only on documented instructions, security measures, sub-processor controls, data breach notification within 72 hours, and support for data subject rights. This section must comply with NDPA 2023 Sections 37 to 43.

Physical security standards: access control systems (biometrics, CCTV, security personnel), visitor policies, client access procedures, and security audit rights. For CBN-regulated financial institution clients, the CBN Cybersecurity Framework requires documented physical security controls at outsourced data centers.

Data sovereignty and localisation: express confirmation that client data will be stored within Nigeria; restrictions on replication or transfer of data outside Nigeria without prior written consent; and the Host's obligations to comply with NDPA 2023 cross-border data transfer requirements.

Disaster recovery and business continuity: the Host's obligations for backup power, fire suppression, flood protection, and the availability of secondary facilities; the Client's access to run its own disaster recovery tests; and the procedures for recovery from a major facility outage.

Termination and data return: procedures for the return or secure destruction of client equipment and data on termination of the agreement, including timelines and costs, compliant with NDPA 2023 data retention and deletion obligations.

Governing law and dispute resolution: Nigerian law as governing law, jurisdiction of the Lagos State or Federal High Court, or arbitration under the Arbitration and Conciliation Act (ACA) 2023.

Additional compliance elements for a Data Center Hosting Agreement (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.