The urgency of reconciling the territorial limits of sovereign jurisdiction with the deterritorialised movement of data is a question of data sovereignty.\u00a0Within Africa, this question is ambitiously addressed by Nigeria\u2019s package of regulatory frameworks, which combines a comprehensive data protection statute, detailed implementation regulations, a draft Digital Sovereignty Bill, and a national AI policy\u2014\u00a0a combination without a clear analogue elsewhere on the continent. Yet, political will and robust regulatory drafting are not sufficient to guarantee data sovereignty. The case of Nigeria illustrates why. Nigeria\u2019s data-regulation architecture, however well-drafted, operates within what this post terms a regulatory-command asymmetry: a structural gap between lawful assertion of prescriptive jurisdiction and the capacity to enforce it, produced by the interaction of Nigerian regulatory instruments with the extraterritorial reach of another state\u2019s public law over the same corporate entity. The gap is not doctrinal. It is a function of the infrastructural, economic, and diplomatic leverage that conditions the exercise of effective jurisdiction\u2014 leverage which Nigeria, and the wider continent, presently lack in relation to the corporate parents that hold the data.<\/p>\n
The discussion in this blogpost\u00a0demonstrates how the operative instrument of extraterritorial jurisdiction asserted by the United States\u2014 the Clarifying Lawful Overseas Use of Data Act (CLOUD Act<\/a>) 2018\u2014 produces the regulatory-command asymmetry that structurally overrides Nigerian prescriptive jurisdiction, and then offers recommendations for rectifying it.<\/p>\n The Architecture and the Instrument<\/strong><\/p>\n Nigeria\u2019s data sovereignty architecture is ambitious. Signed on 12 June 2023, \u00a0the Nigeria Data Protection Act 2023<\/a> (NDPA), establishes extraterritorial application in section 2(2), applying to any data controller or processor handling the personal data of Nigerian subjects,\u00a0regardless of location. To regulate data flows, section 41 restricts cross-border transfer of personal data,\u00a0conditioning it under sections 41(1) and 42 on the recipient providing an adequate level of protection that is substantially similar to the NDPA.\u00a0Alternatively, section 43 permits cross-border transfers under six specific exceptions known under the NDPA as derogations. Finally, the Act creates the Nigeria Data Protection Commission (NDPC) as the primary regulator. The General Application and Implementation Directive<\/a> (GAID) 2025\u00a0operationalises the NDPA with detailed compliance obligations, such as the requirements, per art.\u00a07, for data controllers and processors to register with the NDPC and to file NDP Act Compliance Audit Returns with the same NDPC, not later than the 31st of March every year. The draft Nigeria Digital Sovereignty and Fair Data Compensation Bill 2025 and the draft National AI Commission Bill 2025\u2014both illustrations of political momentum for digital sovereignty\u2014 are currently in active legislative development<\/a>. This is among the most comprehensive digital-sovereignty packages in Africa<\/a>. These frameworks, however, have not secured effective data sovereignty and, given the structural subordination of territorial jurisdiction to external legal commands, are unlikely to do so. Effective data sovereignty necessitates the actual operational\u2014not just legal\u2014capacity of a state to determine the conditions under which data generated by, about, or held in respect of its residents and territory can be accessed, processed, or transferred.<\/p>\n Section 2713 of Title 18<\/a> of the US Code, the reason for the lack of effective data sovereignty, added by the CLOUD Act<\/a>, compels providers subject to US jurisdiction to preserve, back up, and disclose the contents of wire or electronic communications and other records within the provider\u2019s possession, custody, or control, regardless of whether the data is located inside or outside the United States. The statute operates on the corporate parent and reaches any data the parent controls, including data held by Nigerian subsidiaries and on infrastructure located in Lagos or elsewhere. Section 2523 authorises executive agreements creating reciprocal direct-access channels with qualifying foreign governments. Presently, only the United Kingdom<\/a> and Australia<\/a> qualify and have entered into such agreements.<\/p>\n The NDPA and the CLOUD Act therefore constitute competing assertions of jurisdiction\u00a0over the same data \u2014 personal data of Nigerian residents held by US-parented providers \u2014 with incompatible commands. The NDPA regulates the same entity that is subject to the CLOUD Act\u2019s command. This is the regulatory-command asymmetry: a familiar tension between jurisdiction to prescribe and jurisdiction to enforce, but one that is produced here not through inter-state conflict of laws in the classical sense but through the corporate form itself.\u00a0The attempt to treat this asymmetry simply as a conflict-of-laws issue presupposes a symmetric relationship between states and an adjudicable disputation that is not obtainable in the specific instance. First, the jurisdictional conflict is asymmetric: the US command reaches the corporate parent regardless of what Nigeria commands the local subsidiary, and Nigeria has no symmetrical capacity to reach a US parent if it disagreed. Second, this asymmetry is not a feature of any disputation, characteristic of conflict-of-laws analyses, but rather a consequence of how the corporate form and US extraterritorial jurisdiction constitute the architecture in which Nigeria\u2019s data sovereignty is foreclosed. Put differently, the conflict is adjudicated before<\/em> a conflict-of-law analysis.\u00a0Contrarily, a Yale ISP white paper<\/a>\u00a0on this issue, which focused on the conflict-of-laws register, engaged with the Global South in passing. Moreover, the same paper accepted that \u201cthe primary reason for the failure to resolve the internet jurisdictional puzzle to\u00a0date lies in the compartmentalization of the discourse\u201d but failed to engage a political-economy lens.<\/p>\n By converting structural questions into technical-juridical questions of choice-of-law, choice-of-remedy, choice-of-jurisdiction, comity analysis etc., the choice-of-law analysis presupposes an adjudicable issue that, as we will see below, is decided not by \u201cwhat is the choice-of-law\u201d but rather \u201cif we are compelled, we hand over the data.\u201d<\/p>\n Regulatory-Command Asymmetry<\/strong><\/p>\n The asymmetry is not theoretical. On 10 June 2025, Anton Carniaux, legal director of Microsoft France, appeared before the French Senate inquiry commission. Asked under oath whether Microsoft France could guarantee French customer data against the reach of US authority, Carniaux\u00a0replied<\/a>: \u201cIf we are compelled, we hand over the data.\u201d<\/p>\n This admission demonstrates a structural issue. It names the mechanism this post calls the regulatory-command asymmetry, i.e. the structural subordination of host-state civil regulation to home-state criminal investigation commands over the same corporate entity. Several features produce this outcome.<\/p>\n The asymmetry is therefore not a drafting defect in the NDPA. Pending legislative interventions requiring data localisation will prove no more useful. The deeper implication \u2014 which the European Union has confronted \u2014 is that Article 48 GDPR<\/a>, which restricts the transferral of data upon a court order under certain conditions, could not prevent the Carniaux admission. Nigerian drafting will not do better than the GDPR by legislating harder.<\/p>\n A second dimension compounds the first. The CLOUD Act\u2019s \u00a7 2703(h) provides a statutory comity framework but only for customers of providers in qualifying countries under \u00a7 2523. Non-qualifying states, including Nigeria and effectively all of Africa, are left with residual common-law comity analysis<\/a>. Common-law comity tends to favour the US interests since it is discretionary, provider-initiated, depends on the forum court\u2019s initiative, and is ultimately applied in a way that prioritises domestic interests. Nigerian data subjects are thus doctrinally excluded from the procedural protections that US law extends to customers in qualifying countries: qualifying countries receive reciprocal access and statutory comity; non-qualifying countries receive neither.<\/p>\n The Path Forward?<\/strong><\/p>\n First, the path forward begins with the recognition that ambitious data-localisation laws and genuine expressions of data sovereignty cannot, on their own, renegotiate the structural asymmetry between Nigeria and US hyperscalers.<\/p>\n\n