XcellHost|Nigeria Go-To-Market Strategy

Some of it can be transferred, but not by default. The NDPA allows cross-border transfers where the destination is adequate or another basis applies, such as binding corporate rules or contractual clauses. NITDA's 2019 cloud policy requires sensitive government and citizen data to stay in Nigeria, and the NDPC fined MultiChoice partly for unlawful transfers. So customer data stays in a Lagos or Abuja partner DC, and Mumbai runs tooling, monitoring and second-line support under a documented transfer basis.

The General Application and Implementation Directive took full effect on 19 September 2025 and repealed the NDPR 2019 and its 2020 framework. It sets out how to apply the NDPA, including DPIAs and rules for AI, blockchain and IoT. Large controllers, such as banks, telcos, insurers, fintechs, hospitals and universities, file Compliance Audit Returns through a licensed DPCO by 31 March each year. Not filing can cost the greater of ₦10 million or 2% of annual gross revenue.

The 2024 amendment to the Cybercrimes Act sets a levy of 0.5% (0.005) of electronic transaction value for businesses listed in its Second Schedule. The CBN's May 2024 circular telling banks to collect it was suspended and withdrawn after public objections, and in September 2024 the CBN said it would continue to enforce it. We could not confirm how it is applied in November 2026, so treat it as a point for Nigerian counsel. It does not change what XcellHost sells.

The CBN's risk-based cyber framework for deposit money banks and payment service banks has applied since 1 July 2024. Banks must monitor and detect incidents, respond in-house or through an outsourced provider at short notice, and report incidents to the CBN within 24 hours. They also need CBN approval before deploying emerging technologies. Expect detailed due diligence on our SOC, incident runbooks and data location.

We found no AI-specific law in force. The National AI Strategy, launched in April 2025, has 12 goals and 34 initiatives, and a 2025 review noted it has no dedicated budget lines or statutory backing. The pending National Digital Economy and E-Governance Bill would add AI rules by risk category and give digital signatures legal equivalence. Customers mainly need AI governance, literacy and secure platforms, which suit our advisory and training offers.

From 1 January 2026, non-residents supplying Nigerian customers, including with cloud services, register for VAT at 7.5% and charge and remit it, or the customer may self-account. Withholding tax of 5% to 20% on payments to non-residents can act as a final minimum tax, and doubles without a Nigerian tax ID. A Nigerian company pays CIT at 30% plus a 4% development levy unless it qualifies as small. Get advice for each contract structure.

Analysts define markets differently. For cloud, Ken Research put cloud and data-centre services at US$280 million for 2024, while Mordor and Expert Market Research put cloud at about US$1.03 to 1.05 billion for 2025. Data-centre capacity is 56.1 MW on one count and 65 to 86 MW on another. We show both ends with sources and do not average them.

No. The 18-month goals and the revenue model use assumptions for target accounts, win rates and contract values, chosen to start a discussion. Change them in the revenue model. Only the market-size, legal and macro figures come from cited third parties.