NIMC Says Nigeria’s Core Identity Database Remains Hosted Locally

Nigeria’s National Identity Management Commission says its core national identity database is hosted entirely within the country and managed by its own employees.

Alvan Ikoku, director of NIMC’s Strategic Programme Office, said at a Wednesday briefing that the commission had never hosted its identity data outside Nigeria. He also said the core database was not hosted on cloud infrastructure.

Ikoku described the arrangement as internal management rather than outsourcing to local technology vendors. “It is being managed by Nigerians, not Nigerian vendors, by NIMC employees,” he said.

The commission’s position has come amid broader questions about how identity information is accessed through verification channels. The source reporting the briefing said local storage alone does not establish who can access data or how responsibility would be assigned in cases of misuse.

Oversight and access

Ikoku said NIMC employees, particularly those responsible for managing the database, are subject to continuing scrutiny by security agencies. He added that staff could face legal consequences for misconduct.

NIMC also maintains disaster-recovery systems, according to Ikoku, to help keep services operating when systems fail. The source did not independently verify the commission’s claims about local hosting, internal management or its recovery arrangements.

Licenced partners and connected government agencies provide additional points through which identity verification can take place. NIMC previously said that XpressVerify was not a licenced partner and ordered an investigation into whether authorised verification agents or their sublicensees had breached licensing agreements. The Nigeria Data Protection Commission later said NIMC suspended database access before restoring limited access to institutions providing essential public services.

The source said those earlier concerns related to access through verification channels and did not establish that NIMC’s central database had been compromised.

Government integration

Ikoku said about 63 government agencies had integrated with NIMC. Agencies with systems ready for connection can use NIMC’s application programming interface in about 72 hours, he said, while broader work to harmonise records and systems requires more customised integration.

He said some agencies lacked the digital maturity needed to complete the technical connection. The integrated organisations include bodies involved in examinations, student finance, consumer credit and health insurance, according to the source.

Ikoku said NIMC’s role is to authenticate identities and that the commission does not retain the reasons other organisations give for verification requests. He said neither NIMC nor its agents or assignees would retain that information.

He also said users could manage or withdraw consent through NIMC’s authentication application, subject to legal exceptions. The briefing did not provide usage figures or a demonstration of how the process works in practice.

Data protection and digital identity plans

According to Ikoku, the 2026 NIMC Act requires compliance with the Nigeria Data Protection Act and sets conditions for disclosing information about registered people. These conditions include consent, legal obligations, public-interest functions, criminal investigations and court proceedings.

NIMC is also developing frameworks for digital credentials, certificates and signatures. Technical standards, governance arrangements and implementation regulations for those frameworks are still being prepared.

NIMC reported that 142 million Nigerians had registered for National Identification Numbers by September 2026. The commission’s local-hosting position comes as other Nigerian institutions pursue data-localisation measures, including a Central Bank of Nigeria direction requiring banks and payment companies to store and manage payment transaction data generated in Nigeria locally by January 1, 2027.