NIMC Says Nigeria’s National Identity Database Is Hosted and Managed Locally

Nigeria’s National Identity Management Commission says its core national identity database is hosted within the country and managed internally by NIMC employees.

Alvan Ikoku, the commission’s director of Strategic Programme Office, made the disclosure during a briefing with journalists on data storage, infrastructure control, security and access governance.

Ikoku said NIMC had never hosted its identity data outside Nigeria and did not use cloud hosting for its core database. He said the system was managed by Nigerians, specifically NIMC staff rather than Nigerian vendors.

Access remains a key issue

The local-hosting claim places attention on how access to the database is controlled and monitored. NIMC employees, especially those involved in database management, are subject to continuing scrutiny by security agencies and could face legal consequences for misconduct, according to Ikoku.

NIMC also relies on licensed partners and connected government agencies to provide identity-verification services. Ikoku said about 63 government agencies had integrated with the commission. Agencies with systems ready for integration can connect through NIMC’s application programming interface in about 72 hours, while broader efforts to harmonise records and systems require more customised work.

“It is one thing to be ready to integrate with an agency,” Ikoku said, explaining that some institutions had not reached the level of digital maturity needed for a full technical connection.

He said NIMC’s role is to coordinate authentication and verification, rather than retain the reasons why another organisation requests a verification. “It is not the commission’s business to retain the reason for that request or for that authentication,” he said.

Data disclosure and consent

Ikoku said the 2026 NIMC Act requires compliance with the Nigeria Data Protection Act and sets conditions for disclosing information belonging to registered persons. These conditions include consent, legal obligations, public-interest functions, criminal investigations and court proceedings.

Users would be able to manage or withdraw consent through NIMC’s authentication application, subject to legal exceptions, he said. The supplied information does not include figures or a demonstration showing how users would review access records, challenge misuse or file complaints through the application.

NIMC has also said it is developing frameworks for digital credentials, certificates and digital signatures. The standards, governance arrangements and implementation regulations for those systems are still being developed.

Broader localisation debate

NIMC’s statements come amid wider discussions in Nigeria about keeping citizens’ personal information under domestic control. The Central Bank of Nigeria reportedly directed banks and payment companies in June 2026 to store and manage payment transaction data generated in Nigeria locally by January 1, 2027. The government’s National Sovereign Cloud Initiative was reportedly formalised in August to expand local cloud infrastructure.

Questions about identity-data access have previously focused on verification channels. Reports concerning XpressVerify in March 2024 prompted questions about how the platform obtained access to Nigerians’ identity information. NIMC said the platform was not a licensed partner and ordered an investigation into whether authorised agents or their sublicensees had breached licensing agreements.

The Nigeria Data Protection Commission later said NIMC had suspended database access before restoring limited access to institutions providing essential public services.

NIMC reported that 142 million Nigerians had registered for National Identification Numbers as of September 2026. Ikoku also said the commission maintains disaster-recovery systems intended to keep services running when systems fail.