DIGITAL IDENTITY, DATA SOVEREIGNTY, AND REGULATORY COMPLIANCE: A COMPARATIVE STUDY OF NDPR AND GDPR IN CLOUD SERVICE DEPLOYMENT

Cloud services allow identity information to be processed across several organisations and jurisdictions as part of one transaction. The flexibility they offer leads to a governance issue in that merely knowing where a database is located does not mean that one can tell who is permitted to access its contents or what legal obligations apply. This paper looks at Nigeria's Data Protection Regulation (NDPR) 2019 and the European Union's General Data Protection Regulation (GDPR), with a focus on identity management, sovereignty and cloud deployment. To examine the primary regulatory documents and technical guidance, a qualitative documentary approach is employed. The historical comparison is separated from Nigeria's present framework, which consists of the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025. The analysis shows that both regimes have similar privacy objectives but differ in respect of territorial scope, lawful processing, and transfer governance. An original reference architecture and a deployment-screening algorithm are used to turn these issues into practical engineering decisions. A hypothetical university platform is used to show how authentication services, backups, and support access can introduce risks that go beyond those of the main database. The paper contends that a defensible cloud deployment needs a combination of proportionate identity verification, controlled data flows and ongoing oversight based on evidence. The framework proposed is conceptual and no actual system or statistical performance claim is made