Nigeria’s National Identity Management Commission (NIMC) says its national identity database is hosted completely in Nigeria and managed by its personal staff, as digital identity verification turns into more and more vital to public companies.
Alvan Ikoku, director of NIMC’s Strategic Programme Office, disclosed this throughout a briefing with journalists on Wednesday, addressing considerations about the place Nigerians’ identity information is saved, who controls the infrastructure, and the way the fee protects it from leaks.
“It is being managed by Nigerians, not Nigerian vendors, by NIMC employees,” Ikoku stated. He maintained that NIMC has by no means hosted its identity information exterior the nation, doesn’t use cloud internet hosting for its core database, and has catastrophe restoration programs to maintain companies working when programs fail.
The feedback come as information localisation more and more dominates conversations in Nigeria about management over residents’ private data. Keeping information inside national borders addresses the place it is saved, however defending it requires efficient controls over who can entry it and accountability when it is misused.
142 million Nigerians have registered for National Identification Numbers as of September 2026, in line with NIMC. A breach might expose hundreds of thousands’ private information, whereas an outage might disrupt important companies. Local internet hosting alone can’t assure safety; tight entry controls, monitoring, and accountability for misuse are additionally crucial.
Ikoku stated NIMC maintains its core database internally and topics staff, notably these answerable for database administration, to ongoing scrutiny by safety businesses. He added that workers might face authorized penalties for misconduct.
Keeping the central database underneath inner management doesn’t imply NIMC controls each level via which identity information is accessed. Licenced companions and related authorities businesses additionally play a job in delivering verification companies, creating extra factors the place entry to private data have to be managed and secured.
Previous safety considerations have centred on entry via verification channels, relatively than a confirmed compromise of the central database. In March 2024, studies about XpressVerify, an internet site providing Nigerians’ identity data, raised questions on how the platform obtained entry.
NIMC beforehand stated XpressVerify was not a licenced accomplice and ordered an investigation into whether or not authorised verification brokers or their sublicensees had breached their licensing agreements. The Nigeria Data Protection Commission later stated NIMC had suspended database entry earlier than restoring restricted entry to establishments offering important public companies.
The episode highlights a key distinction between information residency and entry governance. Storing identity information on infrastructure inside Nigeria doesn’t, by itself, stop publicity via organisations authorised to request verification.
That threat grows as extra establishments connect with the identity system. Ikoku stated about 63 authorities businesses had built-in with NIMC, together with organisations concerned in examinations, pupil finance, shopper credit score and medical insurance.
“It is one thing to be ready to integrate with an agency,” Ikoku stated. “All we need to do is to offer the application programme interface, which they would use. But what I’ve also discovered working on this harmonisation project is that some of them have not attained—should I call it—the maturity level, the digital maturity level, to be able to even have that handshake in terms of integration.”
For businesses whose programs are prepared, connecting via NIMC’s software programming interface (API) can take about 72 hours, Ikoku stated. Harmonising information and programs, nonetheless, requires extra customised work.
Ikoku stated the 2026 NIMC Act requires compliance with the Nigeria Data Protection Act and units circumstances for disclosing registered individuals’ data. These embrace consent, authorized obligations, public-interest capabilities, felony investigations and court docket proceedings.
He stated NIMC’s function is to authenticate identities, not retain the explanations behind verification requests made by different organisations.
“The commission is supposed to coordinate authentication and verification, but the authentication that the commission needs to make may be coming from another entity,” Ikoku stated. “It is not the commission’s business to retain the reason for that request or for that authentication. The commission will not do that. Neither will its agents or assignees do that in any way.”
Ikoku stated customers might handle and withdraw consent via NIMC’s authentication software, topic to authorized exceptions. However, the briefing offered no utilization figures or demonstration of how residents might examine entry information, problem misuse or file complaints.
NIMC is additionally growing frameworks for digital credentials, certificates and signatures because it modernises its identity infrastructure, Ikoku stated. The technical requirements, governance preparations and implementation rules are nonetheless being developed.
The push to maintain delicate information in Nigeria extends past identity administration. In June 2026, the Central Bank of Nigeria directed banks and cost corporations to retailer and handle cost transaction information generated within the nation locally by January 1, 2027. The authorities’s National Sovereign Cloud Initiative, formalised in August, equally goals to increase native cloud infrastructure.
True scale calls for shifting past surface-level integrations to sturdy execution. We’ve filtered the noise out of Moonshot 2026, optimising the convention strictly for high-calibre connections between startup founders, international monetary operators, enterprise leaders and people rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a restricted time.
