Nigeria's National Identity Management Commission (NIMC) says its national identity database is hosted entirely within the country and managed by its own employees, a statement that comes as digital identity verification grows increasingly central to public services.

Alvan Ikoku, director of NIMC's Strategic Programme Office, disclosed the details during a briefing with journalists on Wednesday. He addressed concerns about where Nigerians' identity data is stored, who controls the underlying infrastructure, and how the commission protects it from leaks.

"It is being managed by Nigerians, not Nigerian vendors, by NIMC employees," Ikoku said. He maintained that the commission has never hosted its identity data outside Nigeria, does not rely on cloud hosting for its core database, and operates disaster recovery systems to keep services running when failures occur.

The comments arrive as data localisation increasingly dominates Nigerian conversations about control over citizens' personal information. Keeping data within national borders addresses where it is stored, but protecting it requires effective controls over who can access it and accountability when it is misused.

According to NIMC, 142 million Nigerians had registered for National Identification Numbers—the unique identifiers assigned to each registered person—as of September 2026. A breach could expose the personal data of millions, while an outage could disrupt essential services. Local hosting alone cannot guarantee security; tight access controls, monitoring, and accountability for misuse remain critical.

Ikoku said NIMC maintains its core database internally and subjects employees—particularly those responsible for database management—to ongoing scrutiny by security agencies. Staff could face legal consequences for misconduct, he added.

Internal control of the central database does not mean NIMC oversees every point through which identity data is accessed. Licenced partners and connected government agencies also help deliver verification services, creating additional points where access to personal information must be managed and secured.

Previous security concerns have centred on access through verification channels rather than a confirmed compromise of the central database. In March 2024, reports about XpressVerify, a website offering Nigerians' identity information, raised questions about how the platform had obtained access. NIMC said at the time that XpressVerify was not a licenced partner and ordered an investigation into whether authorised verification agents or their sublicensees had breached their licensing agreements. The Nigeria Data Protection Commission later said NIMC had suspended database access before restoring limited access to institutions providing essential public services.

The episode underscores a key distinction between data residency and access governance. Storing identity records on infrastructure within Nigeria does not, on its own, prevent exposure through organisations authorised to request verification—a risk that grows as more institutions connect to the identity system.

Ikoku said about 63 government agencies had integrated with NIMC, including organisations involved in examinations, student finance, consumer credit, and health insurance.

"It is one thing to be ready to integrate with an agency," Ikoku said. "All we need to do is to offer the application programme interface, which they would use. But what I've also discovered working on this harmonisation project is that some of them have not attained—should I call it—the maturity level, the digital maturity level, to be able to even have that handshake in terms of integration."

For agencies whose systems are ready, connecting through NIMC's application programming interface (API) can take about 72 hours, according to Ikoku. Harmonising records and systems, however, requires more customised work.

Ikoku also said the 2026 NIMC Act requires compliance with the Nigeria Data Protection Act and sets conditions for disclosing registered persons' information, including consent, legal obligations, public-interest functions, criminal investigations, and court proceedings.

NIMC's role, he said, is to authenticate identities rather than retain the reasons behind verification requests made by other organisations.

"The commission is supposed to coordinate authentication and verification, but the authentication that the commission needs to make may be coming from another entity," Ikoku said. "It is not the commission's business to retain the reason for that request or for that authentication. The commission will not do that. Neither will its agents or assignees do that in any way."

Users can manage and withdraw consent through NIMC's authentication application, subject to legal exceptions, Ikoku said. However, the briefing offered no usage figures or demonstration of how citizens could check access records, challenge misuse, or file complaints.

NIMC is additionally developing frameworks for digital credentials, certificates, and signatures as it modernises its identity infrastructure, though the technical standards, governance arrangements, and implementation regulations are still being developed.

The push to keep sensitive data in Nigeria extends beyond identity management. In June 2026, the Central Bank of Nigeria directed banks and payment to store and manage payment transaction data generated in the country locally by January 1, 2027. The government's National Sovereign Cloud Initiative, formalised in August, similarly aims to expand local cloud infrastructure. Those pending rules, alongside the central bank's deadline, offer concrete markers of whether the country's localisation push extends from where data is stored to how access to it is governed.