Data sovereignty, open data and the price of coherence

Nigeria’s push toward integrated national data systems in 2026 is more than a technocratic fad. It is a growth strategy. Governments plan better when they can see the economy clearly, and investors commit more confidently when statistics are timely, comparable and trusted. That is why the National Bureau of Statistics has been rallying political and financing support through its “Power of Data” initiative and the National Strategy for the Development of Statistics 2024–2028, framed explicitly as a way to modernise the country’s data system and unlock “data dividends” for development. Yet the ambition runs into a stubborn tension: open data for planning thrives on sharing, while privacy for financial integrity thrives on restraint. Nigeria’s Data Protection Act creates a legal framework for protecting personal information and establishes the Nigeria Data Protection Commission. If we treat openness and privacy as enemies, policy coherence will remain a slogan. If we treat them as complementary layers—public insight without private exposure—Nigeria can build trust and capability at the same time.

The silos are not merely technical; they are political economies

Nigeria’s agency silos persist because data is power, and power rarely yields politely. Control over databases creates operational authority, strategic relevance in policy debates, and budget justification through independent ICT procurement. That is why directives for harmonisation often die quietly at the operational level, where incentives favour “my system” over “our system.” Nigeria’s National Data Strategy is unusually candid about the real work required: it calls for structured data sharing across government-to-government, government-to-business and government-to-citizen channels, while explicitly warning that MDAs must address procedural, regulatory, legal and cultural barriers to sharing. This is where the debate often goes wrong. People frame the “silo problem” as a purely technical interoperability gap. In reality, interoperability is the easy part if incentives align. The harder part is governance: who is the authoritative custodian of foundational datasets, who has access to what, and what consequences follow when an agency refuses to cooperate or mishandles data.

Open data is not the same thing as open personal data

The fastest route to coherence is to separate what should be shared widely from what must be guarded tightly. Open data for economic planning is usually aggregated, anonymised and statistical: inflation baskets, employment trends, trade flows, health indicators and education outcomes. Nigeria already has the beginnings of this architecture through the NBS ecosystem, including its Open Data Portal and National Data Archive. The privacy tension intensifies when policymakers blur that world with operational data—identity records, biometrics, location trails, bank transactions and law-enforcement intelligence. That is the kind of data where misuse destroys trust in weeks. Reuters’ report on the NDPC’s investigation into Temu, including concerns about opaque handling, cross-border transfers and possible breaches of data-minimisation principles, is a reminder that Nigeria is now trying to enforce privacy rules in live markets. In other words, the most coherent path is not “share everything.” It is “share the right things in the right ways,” while making privacy enforcement visible enough to be believed.

Data sovereignty can build resilience, but it can also become a tax

Nigeria’s current sovereignty conversation is understandable. Countries want control over strategically important datasets, and they want digital infrastructure that cannot be switched off by external politics or foreign corporate priorities. NITDA’s National Cloud Policy 2025 leans into that view, affirming sovereign ownership over data assets, proposing a national data classification framework and pushing local data residency requirements within a “Cloud First” approach. The economic upside is clear: domestic cloud capacity, local jobs, clearer jurisdiction for investigations, and potentially stronger cyber posture if standards are enforced. The downside is just as real. Over-zealous localisation can raise costs, reduce access to global infrastructure and slow innovation—especially for startups and firms that depend on cross-border processing, fraud intelligence sharing and global compliance tooling. Other countries have wrestled with this too. India’s data localisation debate shows how sovereignty arguments can collide with civil liberties and implementation complexity, with policy analysts warning that localisation, without checks and balances, can even enable intrusive information gathering. Sovereignty works best when it is precise and risk-based, not emotional and absolute.

What worked elsewhere: exchange layers, not mega-databases

The most useful lesson from advanced digital states is that integration does not require one giant database. Estonia’s model is famous precisely because it is decentralised. Agencies keep their own systems, but they connect through a secure exchange layer—X-Road—so data can move safely when authorised, rather than being permanently pooled. The logic is elegant: it reduces duplication, supports the “once-only” principle for citizens, and strengthens accountability. Research on Estonia’s “government as a platform” approach notes that citizens can see who accessed data relating to them because there is an audit trail, which turns transparency into trust rather than mere rhetoric. This matters for Nigeria because it reframes the debate. The choice is not between silos and centralisation. The smarter choice is between unmanaged silos and governed interoperability: a national data exchange, purpose-based access controls, immutable logs, and strong sanctions for misuse.

Another path: consent rails and purpose-limited sharing

A second international lesson comes from India’s Digital Public Infrastructure approach, which attempts to make data sharing safer through consent-based frameworks rather than blanket integration. India Stack describes DEPA as a secure consent-based data sharing framework, designed to help individuals share data in controlled ways. A practical implementation is the Account Aggregator system, created under the Reserve Bank of India to simplify consented sharing of financial information for services like credit. The important point for Nigeria is not to copy India’s institutions wholesale; it is to copy the design logic. When data is shared purposefully, time-bound, and auditable, privacy and openness stop fighting and start cooperating. The risk, of course, is that consent becomes theatre if citizens do not understand what they are agreeing to, or if companies design dark patterns. That is why governance must combine consent with strong enforcement, plain-language transparency, and penalties that actually bite.

The trade-off: coherence can improve the economy, but centralisation can weaken trust

There are genuine pros to a unified national data framework. Better macroeconomic planning, faster service delivery, reduced fraud through improved identity and verification, more accurate targeting of subsidies, and lower compliance friction for businesses that currently submit similar data repeatedly to different agencies. Nigeria’s National Data Strategy explicitly aims to make data “accessible, shareable, and actionable” while placing security and privacy of citizens’ data at the top of the value proposition. But there are serious cons too. A centralised system can become a single point of failure, a magnet for cyberattacks, and a tool for surveillance if oversight is weak. Even well-intended integration can backfire if citizens fear abuse. That is why the “number one hurdle” is often not APIs or legislation, but trust—between institutions, and between government and citizens. The EU’s GDPR principles—purpose limitation, data minimisation, integrity and accountability—remain a useful mental model precisely because they force states to justify every data action. Nigeria does not need European law; it needs European discipline.

What to do in 2026: make it a collective win, not a turf war

For government, the priority should be architecture and incentives. Start by separating foundational data from operational data, assign single authoritative custodians for foundational datasets, and build a national exchange layer rather than a mega-database. Align budgets so agencies gain from sharing rather than lose relevance, and make compliance measurable: interoperability targets, audit log coverage, breach response times and sanctions for non-cooperation. For regulators, make privacy enforcement visible, consistent and fair. When NDPC investigations and penalties are transparent, trust becomes easier to build. For investors, demand clarity on data governance as part of political and regulatory risk pricing; countries that cannot govern data cleanly usually struggle to govern markets cleanly. For the organised private sector, lean into standards: privacy-by-design, encryption, role-based access, independent audits, and shared fraud intelligence through lawful channels. Nigeria can make openness and privacy coexist, but only if it stops treating data as a possession and starts treating it as shared national infrastructure—governed, audited, and built to earn trust one small, provable improvement at a time.