Nigeria’s identity agency says its database is locally hosted and managed by staff
NIMC says Nigeria’s national identity database is hosted locally and managed by its employees. But as more agencies connect to the system, protecting Nigerians’ personal information depends on access controls and accountability—not just where the data is stored.
Nigeria's National Identity Management Commission (NIMC) has stated that its national identity database is stored locally within the country and overseen by its own staff. This assurance comes amid increasing importance placed on digital identity verification for public services. According to Alvan Ikoku, director of NIMC's Strategic Programme Office, the database is managed by Nigerians, not foreign vendors, and has never been hosted outside Nigeria.
The commission employs disaster recovery systems to ensure continuous service delivery even in the event of system failures. As data localisation becomes a hot topic in Nigeria, maintaining data within national borders is crucial, but effective controls over access and accountability are equally important. Currently, 142 million Nigerians have registered for National Identification Numbers, and a breach could expose the personal data of millions.
NIMC maintains its core database internally, subjecting employees, particularly those responsible for database management, to scrutiny by security agencies. However, the commission does not control every point of access for identity data, as licensed partners and connected government agencies also play a role in delivering verification services.
In March 2024, there were concerns about XpressVerify, a website offering Nigerians' identity information, but NIMC confirmed that the platform was not a licensed partner. The Nigeria Data Protection Commission later suspended database access before restoring limited access to essential public services. About 63 government agencies have integrated with NIMC, but some may lack the digital maturity to integrate effectively.
The 2026 NIMC Act requires compliance with the Nigeria Data Protection Act, setting conditions for disclosing registered persons' information, such as consent, legal obligations, public-interest functions, criminal investigations, and court proceedings. NIMC's role is to authenticate identities, not retain the reasons behind verification requests made by other organizations.
Users can manage and withdraw consent through NIMC's authentication application, although the briefing did not provide figures on how citizens could check access records, challenge misuse, or file complaints.
Written by urgent.news from TechCabal's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
