For generations, finding a home in Nigeria meant fluency in landmarks: “Turn left at the blue container, look for the mango tree, and stop before the brick fence.” That tradition is now being retired. On October 1, the government launched the National Digital Al Postcode System (NDAPS), assigning unique 11-character codes to “addressable buildings” across the country.

The system is designed to pinpoint individual buildings, making it easier to route deliveries, dispatch emergency response, verify customers for financial services and deliver government programmes. But the more accurately the system locates buildings, the more valuable its data becomes — and the more it matters who can access and control it. NDAPS raises questions about where the data is stored, who can reach it and what a breach could expose. It also tests Nigeria's ability to protect a database that pinpoints buildings nationwide, just as the government pushes for greater control over its digital infrastructure.

A postcode that points to a building

The new system assigns an 11-character alphanumeric code to every building that can be assigned an address. A single code narrows a location from state level down to a single structure:

• Characters 1–2, two letters — State/FCT: The first two letters identify the state or Federal Capital Territory. In the official NIPOST sample postcode, FC 02 A09 DB 09, “FC” represents the FCT.
• Characters 3–4, two digits — Local government: These digits identify the local government area within the state or territory. The sample uses “02”; NIPOST's explainer does not assign it an LGA name.
• Characters 5–7, three characters — District: The next three characters identify the district, the primary unit used for postal sorting. The sample district code is “A09”.
• Characters 8–9, two letters — Area: These two letters identify an area within the district, which can contain no more than 99 buildings. The sample area code is “DB”.
• Characters 10–11, two digits — Building: The final two digits identify the individual building as a GIS-located delivery point. The sample building code is “09”.

NIPOST notes that a code identifies a building, not a person, and that the sample illustrates the format rather than confirming any real address. The official format is published on NIPOST's postcode portal, with a detailed explainer on the new alphanumeric system. The format details were checked against NIPOST's official material on October 8, 2026.

The cost of bad addressing

Speaking during the launch on October 1, Bosun Tijani, Nigeria's Minister of Communications, Innovation and Digital Economy, said the country loses an estimated ₦50 billion ($37.66 million) to ₦80 billion ($60.26 million) a year to missed and failed deliveries linked to poor addressing. Yet, Tijani stressed, the addressing crisis stretches far beyond parcels.

“Where is your home?” he asked. “Where is your business? Where should an ambulance go in an emergency? Where should a package be delivered? And where should government provide critical services? For too long in Nigeria, answering that simple question accurately has been more difficult than it should be. The consequences are significant.”

An accurate address can help an ambulance reach a patient faster, allow a bank to confirm where a customer lives or where a business operates, and enable a food delivery rider to find a customer without relying on directions anchored to a nearby petrol station or landmark.

For businesses such as restaurants, the benefit is immediate. Blessing John, who runs a food business in Abuja, Nigeria's capital, said the system could make deliveries easier. But she raised a concern about what happens to the information once it enters the system. “If the postcode is compromised, what happens to us?” she said.

The sovereignty question

The infrastructure behind NDAPS deserves attention because Nigeria has been steadily asserting more control over where sensitive data resides. In August, the federal government unveiled its National Digital Cloud Policy, which sets requirements around the protection, residency and control of certain government and regulated data. Also in August, the National Information Technology Development Agency (NITDA) and the Budget Office established a technical committee to advance the National Sovereign Cloud Initiative, covering the financial, procurement and investment framework needed to build greater domestic control over cloud infrastructure.

The Central Bank of Nigeria is moving in the same direction. In a June 15 circular, it directed financial institutions and payment participants to store and manage payment transaction data generated in Nigeria within the country. The requirement takes effect on January 1, 2027.

For categories of sensitive or regulated information, Nigeria wants more control over where data is stored and which legal jurisdictions govern it. That makes the infrastructure behind NDAPS worth examining. TechCabal found that postcode.gov.ng's public-facing infrastructure resolves to Amazon Web Services, a foreign-headquartered cloud provider.

That finding does not, by itself, establish where the underlying NDAPS database is stored, nor does it prove that the postcode data itself sits outside Nigeria — a website's public-facing infrastructure and the location of its databases can differ. But for a government increasingly committed to digital sovereignty, it raises a legitimate question: where exactly does the national postcode database live, and under whose jurisdiction?

Smith Osemeke, founder and chief executive of Unitellas Edge Cloud, a Lagos-based edge cloud platform, believes the issue deserves scrutiny. “Offshore hosting of NDAPS undercuts the government's own localisation message,” he told TechCabal in a telephone interview. “A foreign headquartered provider can be compelled under foreign law and Nigerian authorities cannot guarantee access to, or protection of, the data during a dispute or sanctions episode.”

Beyond cloud ownership, Osemeke's concern extends to what a building-level registry linked to geographic coordinates can reveal. He described the registry as “strategic data” because it can show the location of citizens, critical facilities and security assets.

At the same time, he argues that Nigeria does not lack the infrastructure to host NDAPS domestically, pointing to the country's data-centre portfolio as evidence of capability. A June 2026 analysis by Arizton, a global market research and advisory firm headquartered in Chicago, Illinois, identified 21 operational data-centre facilities in Nigeria and 16 more in development, with Lagos emerging as the country's main digital infrastructure hub. Osemeke says the main NDAPS database needs relatively little storage, and that local cloud providers should be able to handle requests from connected applications and process the system's mapping data.

“Capacity is not the binding constraint as the registry is modest in storage terms,” he said. The bigger factors, he argues, are resilience, compliance and security.

That leaves the sovereignty question with a timeline. The central bank's localisation requirement takes effect on January 1, 2027, while the National Sovereign Cloud Initiative remains at the framework-building stage. Where NDAPS ultimately sits — under Nigerian or foreign jurisdiction — is a question neither NIPOST's published material nor the ministry's response to TechCabal currently answers.

Coverage limits and breach risk

Chidi Omeje, editor-in-chief of Security Digest magazine, a security- and defence-focused publication, is less concerned about digital addressing as an idea than about the limits of its coverage and the consequences of a breach.

“If it's just to cover maybe 25% of the entire country, then it's a useless venture because who told you that the criminals are living in the addressable places?” Omeje told TechCabal in an interview.

Nigeria's security challenges reach well beyond neighbourhoods with formal addresses. Criminal groups also operate in informal settlements, rural communities and remote areas, where limited infrastructure makes mapping more difficult. For Omeje, the digital postcode system will only become a useful security tool if it reaches those places, not just affluent urban neighbourhoods. Its real test is whether it can bring areas long excluded from formal maps into view.

As the government races to build a modern, data-driven economy, it must reconcile the promise of precision with the reality on the ground — ensuring that the infrastructure protecting citizens' data is as robust as the map itself, and that the benefits of connectivity reach every corner of the nation, not just those in “addressable buildings.”

Editor's note: TechCabal reached out to a representative of the Ministry of Communications, Innovation and Digital Economy for comment, but was told that the ministry could not comment on the matter at this time.