Nigeria: Cloud in Oil and Gas

To support the world’s expanding economies and populations, many in the oil and gas (O&G) sector are looking for new ways to keep up with a growing demand for dwindling natural resources. Upstream, midstream, and downstream O&G businesses are quickly shifting away from using the cloud primarily for infrastructure. The cloud is becoming an enabler for successful digital transformation, helping to optimize exploration and production. The O&G sector needs better, faster, and cheaper ways to manage and analyse increasing amounts of data. The cloud offers the solution. It gives companies an ability to vastly improve operational excellence, safety, and productivity, using cloud technologies like advanced analytics, machine learning, and artificial intelligence; all of which enable the real-time use of information to deliver more effective decision-making and business process efficiencies.

Currently, the Nigerian O&G industry is characterised by a fragmented regulatory regime, with different regulators and laws regulating different activities in the upstream, midstream, and downstream sectors, including:

• petroleum operations (including exploration, production and use)¹;
• the establishment, operation and maintenance of pipelines²;
• the participation of the Nigerian National Petroleum Corporation in petroleum operations on behalf of the government³;
• the implementation and development of Nigerian involvement in the O&G industry⁴;
• the assignment of interests in oil and gas assets⁵;
• the import and export of petroleum and petroleum products⁶;
• the transportation and storage of petroleum⁷;
• the administration of matters in connection with the imposition of royalties on the transfer of petroleum resources⁸; and
• the taxation of oil and gas activities in Nigeria⁹.

• Who are the regulators?

  The key regulators for the O&G industry are:

  • Ministry of Petroleum, which deals with policy formulation and provides the general direction to other agencies in the sector for the exploration and production of petroleum resources. It overseas the downstream, midstream, and oil services sectors;
  • The Nigeria National Petroleum Corporation (NNPC), which is the statutory corporation through which the Nigerian Federal Government participates in the oil and gas industry. The NNPC’s primary function is to oversee the regulation of oil industry, with secondary responsibilities for upstream and downstream development;
  • Department of Petroleum Resources (DPR), which is responsible for ensuring; compliance with the terms governing the award of oil licences to companies engaged in petroleum operations;
  • Nigerian Content Development & Monitoring Board (NDMB), which supervises, coordinates, administer, monitors, and manages the development of Nigerian content in the O&G industry;
  • Nigerian Maritime Administration and Safety Agency (NIMASA), which is charged with the responsibility for monitoring and promoting the development of indigenous and commercial shipping in international and coastal shipping trade, and to regulate and promote maritime safety, security and marine labour, amongst other duties; and
  • Niger Delta Development Commission (NDDC), which formulates policies and guidelines for the development of the Niger-Delta area of Nigeria.

• Are cloud services permitted?

  The use of cloud services is not expressly addressed in any Nigerian O&G legislation. There may however be laws of application to the Nigerian O&G industry which may need to be taken into account (see below). In making the decision to move to the cloud, it is crucial for industry participants to consider and ensure compliance with all applicable legislation.

  Microsoft is proud to confirm that it meets regulatory and compliance requirements for use of the cloud in some of the most highly regulated industries across the globe and can help you to achieve compliance with the regulatory and compliance requirements applicable in the O&G sector.

• What are the sector-specific laws and guidelines that need to be considered?

  There is presently no specific or uniform regulation of cloud services in Nigeria. Operators within the O&G industry would, however, need to be mindful of certain regulatory provisions in moving to the cloud, including provisions:

  • granting the regulators access to their records¹⁰;
  • requiring the submission of complete and correct data and accounts¹¹. There is therefore an imperative to store information in a manner which ensures integrity of data and security); and
  • regulating confidentiality¹².

  Although cloud services are not expressly provided for in Nigerian O&G legislation, it is important to note that under the Nigerian Oil and Gas Industry Content Development Act, operators in the Nigerian O&G industry are required to achieve only fifty percent (50%) spend for data management services.¹³ This means that fifty percent (50%) of their spend for data management services shall be exclusively for Nigerian data management service providers.¹⁴

  In addition, there may also be licence and/or contractual provisions (including confidentiality undertakings)¹⁵ which may need to be considered.

• Is approval needed?

  Approval for cloud services is not specifically required in any O&G legislation listed above.

  An O&G industry participant which is an organ of state (such as a national oil company) may be required to follow specific procurement processes in procuring cloud services under applicable public procurement laws. It may also be required to follow certain requirements or obtain waivers or authorisations prior to migrating to cloud services.

• What are the audit / inspection requirements?

  O&G regulators possess fairly broad inspection powers which include the power to search and seize a wide range of information and records¹⁶.

• What are the data transfer requirements?

  There are no offshore data transfer requirements specific to the O&G industry. Under the National Information Technology Development Agency Guidelines on Data Protection (the "Draft Guidelines"), personal information may be transferred out of Nigeria as long as the requirements of the Draft Guidelines are met.¹⁷ The Draft Guidelines will permit the transfer of personal information outside Nigeria where adequate provisions are in place for its protection. This could take the form of legislation or contractual provisions which ensure adequate protection of personal information or could be sanctioned by consent of the data subject.

  Microsoft holds itself accountable to and is subject to laws of general application applicable to information technology service providers, and has binding agreements which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring compliance with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.

• Footnotes

  ¹ The Petroleum Act CAP P10 Laws of the Federation 2010.
  ² The Oil Pipelines Act CAP O7 Laws of the Federation 2010.
  ³ The Nigerian National Petroleum Corporation Act CAP N123 Laws of the Federation 2010.
  ⁴ The Nigerian Oil and Gas Industry Content Development Act CAP.
  ⁵ The Department of Petroleum Resources’ Guidelines and Procedures for Obtaining the Minister’s Consent to the Assignment of Interests in Oil and Gas Assets.
  ⁶ MISSING GET
  ⁷ The Oil Pipelines Act CAP O7 Laws of the Federation 2010.
  ⁸ The Petroleum (Drilling and Production) Regulations
  ⁹ Petroleum Profits Tax Act CAP P13 Laws of the Federation 2010; Companies Income Tax Act CAP C21 Laws of the Federation 2010.
  ¹⁰ Sections 64 and 65 of the Nigerian Oil and Gas Industry Content Development Act provides that operators are to ensure access to facilities and records for assessment and verification purposes.
  ¹¹ The Petroleum (Drilling and Production) Regulations mandate that holders of petroleum licenses keep full and accurate accounts of the quantities of petroleum products and statistics of their operations.
  ¹² Section 58 of the Petroleum (Drilling and Production) Regulations require any information supplied by a licensee be treated by all public officers and other authorities entitled to the information as confidential.
  ¹³ As provided in the schedule to the Nigerian Oil and Gas Industry Content Development Act.
  ¹⁴ As provided in the schedule to the Nigerian Oil and Gas Industry Content Development Act.
  ¹⁵ These include those required in relation to any granting instrument and information or data obtained through and from the Minister of Petroleum Resources. In addition, the Petroleum Act provides that the Minister of Petroleum Resources may prescribe certain terms and conditions for licences issued under the Petroleum Act, including refinery construction/operations and control of petroleum products.
  ¹⁶ Section 8 of the Petroleum Act gives the Minister of Petroleum Resources the power to have access to all areas covered by the relevant licenses for the purpose of inspecting the operations. Section 56 of the Petroleum (Drilling and Production) Regulations allows officials of the Department of Petroleum Resources to enter a licensee’s premises for the examination of its operations and to check its records, documents.
  ¹⁷ Paragraph 4.1.8 of the National Information Technology Development Agency Draft Guidelines on Data Protection in Nigeria