On 14 October 2026, Alvan Ikoku, director of the National Identity Management Commission's Strategic Programme Office, told journalists that Nigeria's national identity database is hosted entirely in Nigeria and run by NIMC's own staff. According to TechCabal's report of the briefing, he said it has never been hosted abroad and does not use cloud hosting for its core database. The briefing gave no usage figures and no way for citizens to check who has looked at their records or to file a complaint.
The case for the claim
The strongest argument for NIMC's position deserves a fair hearing. A national identity register is among the most sensitive datasets a state holds. Keeping it on infrastructure the agency controls, staffed by its own employees, reduces dependence on foreign providers, limits exposure to foreign legal demands, and makes accountability simple: one agency, one location, one chain of command. Governments with weaker institutional capacity have good reason to prefer that, and data-localisation instincts are widespread for this reason.
That is a legitimate security posture. It is also an answer to a narrower question than the one citizens have.
Where the exposure actually sits
A database's physical location says little about who can read it. Identity data is useful only because banks, telecoms, fintechs and government agencies query it, and each of those parties holds credentials or API access. The risk sits at that perimeter.
Nigeria has already seen this. In March 2024 the Nigeria Data Protection Commission (NDPC) opened an investigation into reports of unauthorised access to personal data in the NIMC database, after allegations involving a site called XpressVerify.com. NIMC started its own internal investigation and said it would review its verification protocols. The NDPC's commissioner ordered preliminary findings to be made public within seven days. TechCabal notes that local hosting does nothing to stop exposure through the many agencies and firms authorised to run verification queries, as in that episode.
I could not find a published final report from that probe. That gap is itself the point: if the public cannot see what happened last time, the fact that the servers sit in Nigeria is cold comfort.
The new law raises the stakes
President Tinubu signed the NIMC Act 2026 on 26 June 2026. The State House statement says the Act will harmonise identity databases, strengthen the integrity of the National Identity Number, improve inter-agency collaboration and combat identity theft. Nairametrics reports that it replaces the 2007 law, makes NIMC the root certification authority for the national public key infrastructure, enables data sharing among government agencies, banks and private organisations, and aligns data protection with the Nigeria Data Protection Act. It also reports that amending the old law was a condition for full funding under the $430 million World Bank Identity for Development project.
The design is reasonable. A single trusted identity layer can cut fraud, reduce duplicate registrations, and let small fintechs onboard customers cheaply, which supports innovation. But the Act's own purpose is to connect more parties to the register. More connections mean more query paths, and every path is a potential leak. The question for policy is therefore not where the database lives, but how access is governed.
What proportionate safeguards look like
Nigeria does not need a localisation mandate or a heavier licensing regime to fix this. It needs transparency that matches the access it is granting. The Nigeria Data Protection Act 2023, published by the NDPC, already sets out the framework: it aims to safeguard data subjects' fundamental rights and applies to processing by controllers and processors. The practical gap is operational. Three measures would close it without slowing legitimate use:
- Publish aggregate verification statistics. NIMC gave none at the briefing. Quarterly counts of queries by category of requesting institution would show scale and let researchers spot anomalies, with no personal data revealed.
- Give citizens an access log. A person should be able to see which institutions verified their NIN and when. This is the single most effective deterrent against abuse by authorised parties, because misuse becomes visible to the person harmed.
- Create a clear complaints route and publish outcomes. The 2024 probe promised public findings. Making that a standing practice, with named sanctions where licence terms are broken, would give licensees a reason to behave.
These measures are light-touch. They do not restrict who may innovate on top of the identity layer; they make the cost of misusing it visible.
The risk of mistaking assurances for assurance
The danger in the 14 October briefing is not that Mr Ikoku's statement is false. It may well be accurate. The danger is that it substitutes a reassuring fact about infrastructure for evidence about conduct. Regulators and the public should treat 'hosted locally' as a baseline, not a conclusion.
If Nigeria wants a digital identity system that fintechs, banks and citizens trust enough to use widely, the evidence of trustworthiness has to be checkable. Over-regulating the private firms that build on the register would be the wrong response, and so would blind faith in the custodian. Open metrics, individual audit trails and published enforcement outcomes are the proportionate middle path. As more agencies connect under the new Act, NIMC should treat them as a condition of the expansion, not an optional extra.