Every time someone in Lagos sends a message, uploads a photograph or streams a song, a record of it is written down somewhere. The question almost nobody asks is: where?

For most of the continent, the honest answer is Virginia, Frankfurt or Singapore. The conversation happens in Nigeria. The record of it lives under another country's law.

The law caught up before the infrastructure did

Nigeria now has a real statute. The Nigeria Data Protection Act 2023 requires a lawful basis for every purpose you process personal data for, obliges organisations above a certain size to appoint a Data Protection Officer, and gives you seventy-two hours to notify the Nigeria Data Protection Commission after a breach. Any organisation handling personal data for more than a couple of hundred people is treated as a controller of major importance, with the duties that follow.

Across the continent, the African Union's Malabo Convention on Cyber Security and Personal Data Protection finally entered into force in June 2023, nine years after it was adopted. Nine years is the story in a sentence: the legal architecture exists, but it arrived slowly, and it arrived after the data had already left.

Localisation is not sovereignty

The instinctive policy response is data localisation: a rule that says data about our citizens must be stored on our soil. Several African governments are moving that way, and 2026 has seen a visible push toward local data centre capacity.

But localisation on its own is a weak form of sovereignty, and it is worth being clear-eyed about why. A server in Lagos owned by a foreign hyperscaler, running foreign software, maintained by engineers flown in from elsewhere, is a building in Nigeria. It is not Nigerian capacity. Researchers at CIGI have made this point sharply: digital sovereignty requires local capability, not just local geography. Storage is the easy part. The hard parts are the compute, the engineers, the power supply and the ownership.

Nigeria's own experience makes the case. Intra-African trade rose twenty-one per cent to over nine billion dollars as AfCFTA opened new export markets. Trade grew because the underlying capacity to trade was built. Data will work the same way, or it will not work at all.

What this actually costs you

Sovereignty sounds abstract until it is not. Three concrete consequences:

Jurisdiction. If your data sits under another country's law, that country's courts and agencies decide who may compel access to it. Your rights are whatever that jurisdiction grants you, not whatever your own parliament passed.

Price. Data that leaves the continent to be processed comes back as a service you rent. The value added happens elsewhere. This is a familiar shape: raw material out, finished product in, margin captured abroad.

Capability. Every system built elsewhere is a system African engineers did not build. Capacity is created by doing the work, and there is no shortcut around that.

Where we stand

CelebIsland is a platform built and operated from Africa, and one that speaks Yorùbá, Igbo, Hausa, Kiswahili and Nigerian Pidgin because those are the languages its members actually think in. That is a sovereignty position of a kind: the interface, the moderation decisions and the editorial judgment are made here.

We will not pretend the whole stack is. Like almost every platform on the continent, parts of our infrastructure run on services headquartered elsewhere. Saying otherwise would be marketing, and this article is not marketing.

The point is the direction of travel. Every layer moved closer to home — language, moderation, storage, compute, ownership — is one layer that no longer depends on somebody else's permission. That is what the work looks like. It is unglamorous and it is incremental, and it is the only version that is real.

Sources: Nigeria Data Protection Act 2023; African Union Convention on Cyber Security and Personal Data Protection (Malabo), in force June 2023; CIGI Policy Brief no. 185, "Digital Sovereignty in Africa: Moving beyond Local Data Localization"; AfCFTA trade figures reported June 2026.