Nigeria’s National Identity Management Commission (NIMC) says its national identity database is hosted fully in Nigeria and managed by its personal workers, as digital identity verification turns into more and more vital to public providers.
Alvan Ikoku, director of NIMC’s Strategic Programme Office, disclosed this throughout a briefing with journalists on Wednesday, addressing issues about the place Nigerians’ identity information is saved, who controls the infrastructure, and the way the fee protects it from leaks.
“It is being managed by Nigerians, not Nigerian vendors, by NIMC employees,” Ikoku mentioned. He maintained that NIMC has by no means hosted its identity information exterior the nation, doesn’t use cloud internet hosting for its core database, and has catastrophe restoration techniques to maintain providers working when techniques fail.
The feedback come as information localisation more and more dominates conversations in Nigeria about management over residents’ private data. Keeping information inside national borders addresses the place it is saved, however defending it requires efficient controls over who can entry it and accountability when it is misused.
142 million Nigerians have registered for National Identification Numbers as of September 2026, in response to NIMC. A breach may expose hundreds of thousands’ private information, whereas an outage may disrupt important providers. Local internet hosting alone can’t assure safety; tight entry controls, monitoring, and accountability for misuse are additionally essential.
Ikoku mentioned NIMC maintains its core database internally and topics workers, significantly these chargeable for database administration, to ongoing scrutiny by safety companies. He added that workers may face authorized penalties for misconduct.
Keeping the central database beneath inside management doesn’t imply NIMC controls each level by which identity information is accessed. Licenced companions and related authorities companies additionally play a job in delivering verification providers, creating extra factors the place entry to private data have to be managed and secured.
Previous safety issues have centred on entry by verification channels, reasonably than a confirmed compromise of the central database. In March 2024, reports about XpressVerify, a web site providing Nigerians’ identity data, raised questions on how the platform obtained entry.
NIMC beforehand said XpressVerify was not a licenced companion and ordered an investigation into whether or not authorised verification brokers or their sublicensees had breached their licensing agreements. The Nigeria Data Protection Commission later said NIMC had suspended database entry earlier than restoring restricted entry to establishments offering important public providers.
The episode highlights a key distinction between information residency and entry governance. Storing identity data on infrastructure inside Nigeria doesn’t, by itself, stop publicity by organisations authorised to request verification.
That threat grows as extra establishments hook up with the identity system. Ikoku mentioned about 63 authorities companies had built-in with NIMC, together with organisations concerned in examinations, pupil finance, client credit score and medical health insurance.
“It is one thing to be ready to integrate with an agency,” Ikoku mentioned. “All we need to do is to offer the application programme interface, which they would use. But what I’ve also discovered working on this harmonisation project is that some of them have not attained—should I call it—the maturity level, the digital maturity level, to be able to even have that handshake in terms of integration.”
For companies whose techniques are prepared, connecting by NIMC’s software programming interface (API) can take about 72 hours, Ikoku mentioned. Harmonising data and techniques, nevertheless, requires extra customised work.
Ikoku mentioned the 2026 NIMC Act requires compliance with the Nigeria Data Protection Act and units situations for disclosing registered individuals’ data. These embody consent, authorized obligations, public-interest features, legal investigations and court docket proceedings.
He mentioned NIMC’s function is to authenticate identities, not retain the explanations behind verification requests made by different organisations.
“The commission is supposed to coordinate authentication and verification, but the authentication that the commission needs to make may be coming from another entity,” Ikoku mentioned. “It is not the commission’s business to retain the reason for that request or for that authentication. The commission will not do that. Neither will its agents or assignees do that in any way.”
Ikoku mentioned customers may handle and withdraw consent by NIMC’s authentication software, topic to authorized exceptions. However, the briefing offered no utilization figures or demonstration of how residents may examine entry data, problem misuse or file complaints.
NIMC is additionally creating frameworks for digital credentials, certificates and signatures because it modernises its identity infrastructure, Ikoku mentioned. The technical requirements, governance preparations and implementation laws are nonetheless being developed.
The push to maintain delicate information in Nigeria extends past identity administration. In June 2026, the Central Bank of Nigeria directed banks and cost corporations to retailer and handle cost transaction information generated within the nation locally by January 1, 2027. The authorities’s National Sovereign Cloud Initiative, formalised in August, equally goals to increase native cloud infrastructure.
True scale calls for transferring past surface-level integrations to strong execution. We’ve filtered the noise out of Moonshot 2026, optimising the convention strictly for high-calibre connections between startup founders, international monetary operators, enterprise leaders and people rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.
