Scrutiny is falling on the NIMC national Identity database, with the agency now stating that the data is not held overseas.
The National Identity Management Commission (NIMC) has said that the nation's identity records are held entirely on Nigerian soil and managed by the commission's own personnel. This reassurance matters at a time when a growing number of government services depend on digital identity verification.
Given that 142 million Nigerians are now enrolled on the system as of September 2026, storage location is only part of the picture for the NIMC national identity database. Equally, pressing are questions about who is able to reach the data, how such access is tracked and what the response is if things go wrong.
NIMC Says Local Staff Control Its Records Store
Alvan Ikoku, NIMC's Director of Strategic Programme Office, made the announcement at a media briefing held on October 14.
Ikoku said the commission has at no point kept its identity data abroad. He added that the core database does not run on cloud infrastructure, and that NIMC's own employees administer it directly, not Nigerian technology vendors. The commission also says it operates disaster-recovery systems built to keep the database and linked services running if systems break down.
Employees who manage the database come under the watch of security agencies and may be held legally liable for any misconduct. As a result, Nigeria retains firmer command over where one of its most sensitive digital assets physically sits and how it is administered, and the NIMC national identity database stays under Nigerian control.
Well, that is only one part of the security equation.
Local Hosting Does Not Automatically Mean Complete Security
Keeping identity data inside Nigeria can reduce concerns about foreign storage and control. It can also support data sovereignty and make it easier for Nigerian regulators and institutions to apply domestic rules. However, data localisation and data security are not the same thing. A database can be hosted locally and still face risks if too many people or organisations can access it without adequate controls.
The relevance of this grows because NIMC does not stand alone: roughly 63 government agencies now plug into its identity system, among them bodies working in education, student loans, health insurance and consumer credit. According to Ikoku, any agency whose systems are prepared can link up via NIMC's API, and the technical connection may take under 72 hours.
Every additional connection therefore creates another point at which identity information has to be properly protected.
Nigerians consuming more data in 2026? See details from the experts here.
Nigerians Have Reason to Care About Access
This is where the issue becomes more than a technology story.
NIN records contain highly sensitive personal information, and if such information is exposed or misused, the consequences can extend beyond an inconvenient data leak.
During 2024, worries about the XpressVerify platform prompted questions over how a service with no authorisation managed to get hold of NIN verification credentials. The Nigeria Data Protection Commission stated that, going by its investigation, a third party licensed to offer verification may have let XpressVerify use its credentials. NIMC then curtailed the access of licensed agents pending the outcome of the inquiry.
That episode did not establish that the physical NIMC national identity database itself was hacked. Instead, it highlighted a different vulnerability, which is the channels through which authorised organisations can access identity information. Such a distinction is vital today because NIMC says more institutions are now connected to its system.
Here are more details on the NIMC’s stance against XpressVerify for your reading
NIMC Says Nigerians Will Have More Control
Under the 2026 NIMC Act, Ikoku said the commission must comply with the Nigeria Data Protection Act when disclosing information.
He said disclosure can be based on grounds including:
- Consent from the individual
- Legal obligations
- Public-interest functions
- Criminal investigations
- Court proceedings
Ikoku further said that people will be able to handle their consent, including withdrawing it, through NIMC's authentication app, with certain legal exceptions applying. NIMC maintains that its role is to confirm who people are, not to keep a record of why other organisations ask for verification.
These safeguards could become more important as digital identity becomes embedded in everyday services. NIMC's own website describes the commission as responsible for establishing, owning, operating, maintaining and managing Nigeria's National Identity Database. It is also expanding services around NIN authentication and digital identity.
Public Trust Is the Real Test for the NIMC National Identity Database
NIMC's latest clarification should reassure Nigerians about one specific issue: according to the commission, their core identity records are hosted and managed domestically.
It would be correct to say that public trust will depend on more than where the servers are located. Nigerians will also want confidence that:
- Access to their information is strictly controlled.
- Connected agencies cannot use data beyond what they are authorised to access.
- Unauthorised access can be detected and investigated quickly.
- People have practical ways to challenge misuse of their information.
- Regulators and NIMC are transparent when security incidents occur.
Worth noting too is that NIMC lately rejected claims that the database holding the nation's identity records had been breached, calling such reports untrue and stating that its systems carry multiple layers of security. The commission added that it was looking into whether any licensed verification agents had broken the terms of their agreements. In my personal view, that makes the debate about local hosting well-timed.
Nigeria is building a digital identity infrastructure that could become central to banking, healthcare, education, government services and other parts of the economy. The larger that infrastructure becomes, the more important it is that security, privacy, and accountability grow alongside it. Keeping the identity data of Nigerians in Nigeria is an appreciable step, but earning the trust of Nigerians will greatly depend on what happens to that data after it is stored.