Data Residency for KYC: What the NDPA Requires of Your Verification

What is data residency?

Data residency is the physical or geographic location where an organisation's data is stored and processed. It is usually set by law, regulation or contract. For a KYC provider, it answers a simple question: in which country do your customers' identity records actually sit?

The term is often confused with two others. Data sovereignty means data is subject to the laws of the country where it is located. Data localisation is a legal requirement that certain data must stay inside a country.

For banks, fintechs, payment companies and gaming operators in Nigeria, all three now matter. This guide explains what the NDPA and recent CBN rules require. It then answers the four questions buyers most often ask KYC vendors about data.

Does the NDPA require KYC data to stay in Nigeria?

Not as a blanket rule. The NDPA is a transfer law, not a localisation law. Part VIII of the Act, sections 41 to 43, allows personal data to leave Nigeria only on specific grounds.

The main ground is adequacy. The recipient must be subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification that gives adequate protection. Where that is missing, the Act allows other limited bases, set out in section 43.

In practice, a KYC vendor can store Nigerian customer data abroad, but only with a documented legal basis for the transfer. If it cannot show you that basis, the transfer risk sits with you as the data controller.

What did GAID 2025 change?

The Nigeria Data Protection Commission (NDPC) issued the GAID in March 2025, and it entered into force on 19 September 2025. From that date, the NDPC ceased to apply the Nigeria Data Protection Regulation (NDPR) 2019 as a regulatory instrument. The operative framework is now the NDPA and the GAID.

For transfers, Article 45 and Schedule 5 of the GAID set out the permitted grounds. These include NDPC adequacy decisions and Cross-Border Data Transfer Instruments (CBDTIs) approved by the Commission.

The GAID also requires Data Controllers and Processors of Major Importance to register with the NDPC. An organisation may fall into this category where, among other criteria, it processes the personal data of more than 200 data subjects in six months. Many banks, fintechs and KYC vendors will be covered.

What does the CBN's 2027 data localisation deadline mean for KYC?

This is the change most teams are now planning around. In a circular dated 15 June 2026, the CBN directed that payment transaction data generated within Nigeria be stored and managed in Nigeria. Full compliance is due by 1 January 2027, and the CBN has said the deadline remains unchanged.

The circular focuses on payment transaction data. Whether it also covers identity data collected during KYC is not clearly settled in the reporting available. Treat it as a live question for your legal team, not an assumption.

Vendors still matter even if KYC data falls outside the circular. A vendor that sees your payment data, for example through transaction monitoring, may need to meet the localisation requirement too. Ask your provider where that data is processed today, and what its plan is for January 2027.

Separately, NITDA's Guidelines for Nigerian Content Development in ICT require sovereign data to be hosted in Nigeria. Sovereign data broadly means data that government generates, owns or controls. This matters mainly to government institutions and vendors handling such data, not as a general localisation rule for private KYC data.

Where is our customers' data stored and processed?

Ask for three locations, not one. Where is the data stored at rest? Where is it processed during a verification? Where are backups kept?

Then ask who can access it, and from where. Legal commentators take the view that data accessed from another country can amount to a cross-border transfer, even where the servers are in Nigeria. A support engineer abroad viewing a customer record may therefore trigger the NDPA transfer rules.

For every location outside Nigeria, ask which NDPA transfer basis the vendor relies on. A good answer names it, such as an adequacy decision or an approved transfer instrument, and puts it in the data processing agreement. A vague answer like "our cloud is secure" does not tell you whether the transfer is lawful.

How long do you keep KYC data, and can we delete it?

Two rules pull in different directions here. Nigeria's AML rules require records to be kept. The NDPA requires personal data not to be kept longer than necessary.

The AML side is clear. The Money Laundering (Prevention and Prohibition) Act 2022 (MLPPA) and the CBN Customer Due Diligence Regulations 2023 require financial institutions to keep due diligence records for at least five years after a business relationship ends. Our guide to AML record-keeping requirements for African banks compares this with other markets.

The two fit together if your retention policy states the legal reason for each period. Keep KYC records for at least the AML period, and longer where another law, regulator or legal direction requires it. Then delete or anonymise them. Your vendor should follow your instructions, not its own default.

Ask the vendor how long it keeps verification data after a check completes, and whether that period is configurable. Also ask whether it deletes your data on request and at the end of the contract, and whether it can confirm deletion in writing.

Which sub-processors see our customers' data?

A KYC vendor rarely works alone. A single check can pass through a cloud host, a government or commercial data source, a face-matching engine and a support tool. Each of these is a sub-processor.

Ask for the full sub-processor list, what each one does and where it is located. Then ask how you will be told when the list changes, and whether you can object to a new one.

These terms belong in the data processing agreement, not in a sales email. The NDPC can hold you accountable for how your processors handle data, so you need to know the whole chain.

What certifications should a KYC vendor hold?

Certifications show that a vendor's security controls have been independently checked. The common ones each prove something different.

A certificate is not proof of NDPA compliance. ISO and SOC reports cover security controls. They do not confirm that cross-border transfers have a lawful basis or that retention follows Nigerian law.

Ask for the certificates themselves and check their scope. A certificate that covers only one office or product may not cover the service you are buying. For Nigerian processing, also ask whether the vendor is registered with the NDPC.

Data residency checklist for KYC vendors

Use these questions in every vendor review, and ask for the answers in writing.

How Youverify handles data residency

On its customer onboarding page, Youverify says customer data is processed in regions with adequate data protection regulation. It also says residency commitments are written into the contract, so they are binding rather than promised.

Youverify is registered with the data protection authorities in Nigeria, Kenya, South Africa, Côte d'Ivoire and the United Kingdom. It holds SOC 2 Type II, ISO 27001, ISO 27018 and ISO 42001 certifications.

To review Youverify's data processing terms against your own policy, speak to the team.

Conclusion

Data residency used to be a question for the security questionnaire. In Nigeria it is now a legal and regulatory question, shaped by the NDPA, the GAID and the CBN's 2027 deadline.

Your KYC vendor holds some of the most sensitive data your customers give you. Know where it sits, who can see it and how long it stays, and make sure the contract says so.

 

About the Author

Victoria Okere is a compliance content writer at Youverify, specializing in AML compliance, financial crime risk, regulatory technology, and emerging trends in financial services.