Nigeria’s National Identity Management Commission (NIMC) says its national identity database is hosted entirely in Nigeria and managed by its own employees, as digital identity verification becomes increasingly important to public services.
Alvan Ikoku, director of NIMC’s Strategic Programme Office, disclosed this during a briefing with journalists on Wednesday, addressing concerns about where Nigerians’ identity data is stored, who controls the infrastructure, and how the commission protects it from leaks.
“It is being managed by Nigerians, not Nigerian vendors, by NIMC employees,” Ikoku said. He maintained that NIMC has never hosted its identity data outside the country, does not use cloud hosting for its core database, and has disaster recovery systems to keep services running when systems fail.
The comments come as data localisation increasingly dominates conversations in Nigeria about control over citizens’ personal information. Keeping data within national borders addresses where it is stored, but protecting it requires effective controls over who can access it and accountability when it is misused.
142 million Nigerians have registered for National Identification Numbers as of September 2026, according to NIMC. A breach could expose millions’ personal data, while an outage could disrupt essential services. Local hosting alone cannot guarantee security; tight access controls, monitoring, and accountability for misuse are also critical.
Ikoku said NIMC maintains its core database internally and subjects employees, particularly those responsible for database management, to ongoing scrutiny by security agencies. He added that staff could face legal consequences for misconduct.
Keeping the central database under internal control does not mean NIMC controls every point through which identity data is accessed. Licenced partners and connected government agencies also play a role in delivering verification services, creating additional points where access to personal information must be managed and secured.
Previous security concerns have centred on access through verification channels, rather than a confirmed compromise of the central database. In March 2024, reports about XpressVerify, a website offering Nigerians’ identity information, raised questions about how the platform obtained access.
NIMC previously said XpressVerify was not a licenced partner and ordered an investigation into whether authorised verification agents or their sublicensees had breached their licensing agreements. The Nigeria Data Protection Commission later said NIMC had suspended database access before restoring limited access to institutions providing essential public services.
The episode highlights a key distinction between data residency and access governance. Storing identity records on infrastructure within Nigeria does not, on its own, prevent exposure through organisations authorised to request verification.
That risk grows as more institutions connect to the identity system. Ikoku said about 63 government agencies had integrated with NIMC, including organisations involved in examinations, student finance, consumer credit and health insurance.
“It is one thing to be ready to integrate with an agency,” Ikoku said. “All we need to do is to offer the application programme interface, which they would use. But what I’ve also discovered working on this harmonisation project is that some of them have not attained—should I call it—the maturity level, the digital maturity level, to be able to even have that handshake in terms of integration.”
For agencies whose systems are ready, connecting through NIMC’s application programming interface (API) can take about 72 hours, Ikoku said. Harmonising records and systems, however, requires more customised work.
Ikoku said the 2026 NIMC Act requires compliance with the Nigeria Data Protection Act and sets conditions for disclosing registered persons’ information. These include consent, legal obligations, public-interest functions, criminal investigations and court proceedings.
He said NIMC’s role is to authenticate identities, not retain the reasons behind verification requests made by other organisations.
“The commission is supposed to coordinate authentication and verification, but the authentication that the commission needs to make may be coming from another entity,” Ikoku said. “It is not the commission’s business to retain the reason for that request or for that authentication. The commission will not do that. Neither will its agents or assignees do that in any way.”
Ikoku said users could manage and withdraw consent through NIMC’s authentication application, subject to legal exceptions. However, the briefing provided no usage figures or demonstration of how citizens could check access records, challenge misuse or file complaints.
NIMC is also developing frameworks for digital credentials, certificates and signatures as it modernises its identity infrastructure, Ikoku said. The technical standards, governance arrangements and implementation regulations are still being developed.
The push to keep sensitive data in Nigeria extends beyond identity management. In June 2026, the Central Bank of Nigeria directed banks and payment companies to store and manage payment transaction data generated in the country locally by January 1, 2027. The government’s National Sovereign Cloud Initiative, formalised in August, similarly aims to expand local cloud infrastructure.
True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.