ASSESSING THE EXPANSIVE MANDATE OF THE NIMC UNDER THE NATIONAL IDENTITY MANAGEMENT COMMISSION ACT, 2026
For nearly two decades, Nigeria’s national identity architecture was understood primarily through the language of registration, the National Identity Database, the National Identification Number (NIN), and the General Multi-Purpose Identity Card. The National Identity Management Commission Act, 2007 was enacted within a different technological and regulatory landscape, before the emergence of the present data-protection framework, before digital identity became a central component of public-service delivery, and before interoperability and digital trust assumed the importance they now possess.
The National Identity Management Commission (Establishment) Act, 2026 marks a decisive departure from that model. It repeals and replaces the 2007 Act and substantially enlarges the institutional character of the National Identity Management Commission (NIMC)
The Commission is no longer merely the body responsible for registering persons and maintaining an identity database. It is now positioned at the centre of Nigeria’s digital trust architecture, responsible for the National Public Key Infrastructure (PKI), Digital Public Infrastructure (DPI), secure identity authentication, and interoperable data exchange.
The significance of this change lies not merely in the addition of new functions to an existing agency. It is a reconceptualisation of what national identity is intended to accomplish. The 2026 Act moves Nigeria from “a card-centred identity system to a credential-based and digitally enabled identity framework”, while recognising both physical and digital identity credentials. It also makes the NIN foundational under the principle of “One Person, One Identity”. These reforms indicate that identity is no longer being treated principally as a document that a person carries, but as a trusted digital attribute through which a person may securely establish who they are across different systems.
The institutional transformation is expressly reflected in the Act. Section 7 expands NIMC’s mandate by designating the Commission as the Root Certification Authority and issuing authority for Nigeria’s National Public Key Infrastructure and Digital Public Infrastructure. Section 8 further empowers the Commission to facilitate secure communication and efficient data exchange, including the harmonisation and integration of identification databases and the establishment of secure links with relevant databases and agencies. The result is a legal framework in which NIMC becomes an infrastructure institution, rather than simply an identity-registration institution.
This development is important because digital economies depend upon trusted systems for establishing identity, authenticity and authority. A person opening a bank account, accessing a public service, authenticating a digital transaction or interacting with another institution increasingly needs more than a physical document. The legal system must support a mechanism through which identity can be verified securely, consistently and across institutional boundaries.
The most visible conceptual change under the 2026 Act is the movement away from the idea that identity is synonymous with a card. Under the 2007 framework, identity was largely treated as a material object: a physical card issued to an individual, with detailed statutory attention given to its contents, production, surrender and cancellation. The 2026 Act adopts a different conception. It recognises identity credentials in physical and digital forms and gives the Commission flexibility to issue credentials appropriate to technological developments.
This distinction matters because a credential-based system is capable of supporting authentication without making a particular physical document the sole gateway to identity. The NIMC General Multipurpose Card remains relevant, but it is now better understood as one credential within a wider ecosystem. The card is therefore no longer the centre of the architecture; the underlying identity and the trusted means of authenticating it are.
The NIN is central to this new architecture. The Act reinforces the principle of “One Person, One Identity” and links physical and digital identity credentials to the national identity framework. The legal effect is to strengthen the NIN as a foundational identifier while avoiding the proposition that possession of a particular physical card is itself the complete expression of legal identity.
The innovation becomes more significant when viewed alongside the new PKI mandate. Public Key Infrastructure is fundamentally about digital trust. It enables systems to establish authenticity and integrity through cryptographic mechanisms, including certificates and trusted certification authorities. By making NIMC the Root Certification Authority and issuing authority for the national PKI and DPI framework, the Act places the Commission at the top of a national trust hierarchy.
This is a substantial institutional shift. A registration authority primarily answers the question: “Who is this person?” A root certification authority participates in answering a broader question: “Can this digital identity, credential or transaction be trusted?” The latter has consequences for electronic authentication, digital signatures, secure communications and the wider architecture of electronic government and commerce.
Section 8 deepens this transformation by empowering the Commission to harmonize and integrate existing identification databases and to establish secure communication links with relevant identity-related databases and agencies. The Commission may also establish a framework for secure and efficient data exchange among government agencies, private-sector organisations and other entities. This is the legal infrastructure necessary for interoperability.
The importance of interoperability cannot be overstated. Fragmented databases can require citizens repeatedly to establish the same facts before different public institutions. Properly governed interoperability can instead allow authorized institutions to verify information through secure channels, reduce duplication and improve service delivery. The benefit is not merely technological efficiency; it can reduce administrative burdens and make government services more responsive.
Yet interoperability must not be confused with unrestricted access. The same legal framework that facilitates data exchange must determine who may access information, for what purpose, for how long and subject to what safeguards. The 2026 Act’s DPI ambitions therefore cannot be separated from its data-protection provisions. The more central NIMC becomes to digital infrastructure, the greater the importance of the legal controls surrounding that infrastructure.
The concept of Digital Public Infrastructure gives the 2026 Act its deeper institutional significance. DPI may be understood as foundational digital systems upon which citizens, government institutions and private-sector actors can securely interact. Identity is one such foundational layer; secure data exchange and digital trust are others. By placing these functions within NIMC’s statutory mandate, the Act recognises that a modern identity system can serve as infrastructure for the wider digital economy.
The Act’s approach is particularly significant because it connects identity with interoperability. Section 8 contemplates a framework through which relevant databases and agencies can communicate securely and efficiently. This creates the possibility of a national ecosystem in which authorised institutions can verify identity without maintaining entirely separate and disconnected identity systems.
The significance of this transition is in the observation that a body that once printed cards becomes the trust anchor of Nigeria’s digital economy. It highlights the institutional distance between the 2007 and 2026 frameworks. NIMC’s role now reaches beyond the registration counter into the technical and legal architecture that enables digital interactions.
This wider mandate also intersects with the mandatory use of the NIN. Section 26 makes the NIN relevant to a wide range of transactions, including international passports and voter-related documentation, government benefits, banking, insurance, telecommunications registration, land transactions, taxation and consumer credit. The NIN is therefore not merely an identity number; it becomes an important gateway through which individuals interact with multiple sectors of the Nigerian economy and public administration.
However, the Act contains an important qualification to this breadth of use. Section 26(2) provides that proof of identity does not constitute proof of eligibility for a benefit or service, while section 26(3) provides that the issuance of an NIN or identity credential is not incontrovertible proof of citizenship. These provisions are legally significant because they prevent the identity system from silently becoming a universal determination of entitlement or nationality.
This decoupling is one of the Act’s quietest but most important innovations. Identity, eligibility and citizenship are distinct legal questions. A person may be successfully identified without thereby establishing every other legal status that may be relevant to a transaction. Maintaining those distinctions protects against the possibility that failure to establish one attribute becomes an automatic failure to establish all others.
The Act also introduces a more inclusive registration regime. Section 2 expands the framework for registration, while section 18 provides alternative means of establishing identity where an applicant lacks government-issued identification, including identification under oath by a registered adult relative or another prescribed identifier. The Commission is also required to take special measures for persons without a permanent place of residence. These provisions address a longstanding documentation problem: a person who lacks identity documents may be unable to obtain the very documents needed to prove identity.
The significance of inclusion becomes even clearer within a DPI framework. If identity becomes foundational to banking, telecommunications, public benefits, travel, taxation and other essential services, exclusion from the identity system can translate into exclusion from modern social and economic life. The 2026 Act therefore attempts to ensure that the digital transformation of identity does not become a digital transformation of exclusion.
The expansion of NIMC’s mandate necessarily raises a corresponding question: how should the law protect the individual when one institution becomes a central component of national digital infrastructure? The 2026 Act responds by placing data protection much closer to the heart of the identity regime than was apparent under the 2007 framework.
The new Act requires the National Identity Database to be operated in compliance with the Nigeria Data Protection Act, 2023. Section 24 establishes rules governing disclosure of registered information, including consent requirements and specified grounds for lawful disclosure. The effect is to move the identity framework away from broad institutional discretion and towards a more structured regime of lawful access.
The Act also incorporates privacy-by-design features. Under section 18(10), the NIN must bear no relation to the attributes or identity of its holder. This means that the number itself should not reveal characteristics about the individual. Section 20 further limits the particulars that may appear on identity credentials, while section 25(3) prevents the Commission from keeping a record of the purpose of authentication. The latter safeguard is particularly significant: a system may authenticate an individual without necessarily creating a permanent record of why that authentication occurred.
These provisions reflect a wider principle of purpose limitation. The possession of extensive identity information does not, by itself, create an unlimited legal entitlement to use that information for every conceivable purpose. Data must remain connected to lawful and defined purposes, and access should be governed by necessity, proportionality and accountability.
The Act also strengthens enforcement. Sections 29 to 33 provide for offences and sanctions relating to unauthorised access, identity fraud, impersonation and other prohibited conduct. The Commission is also given investigative powers, including powers relating to search, seizure and arrest. These powers are understandable in a system where identity fraud and unauthorised access can produce serious consequences. They must, however, be exercised consistently with constitutional rights, due process and the rule of law.
This is where the Act’s provisions must be tested most carefully. A powerful identity institution requires powerful safeguards. Enthusiasm should not curdle into credulity. The Act’s most progressive provisions are not self-executing. Their effectiveness depends upon regulations, institutional practice, external supervision and judicial enforcement.
The profession therefore has a continuing role. Courts will be called upon, where necessary, to determine the limits of disclosure, the meaning of statutory safeguards and the legality of exercises of institutional power. The data-protection regulator must supervise without undue deference. NIMC itself must ensure that the technical architecture it develops is matched by appropriate governance controls.
The central legal challenge is therefore to maintain equilibrium. The State has a legitimate interest in reliable identity management, national security, efficient service delivery and the prevention of fraud. Individuals, however, retain rights to privacy, dignity, due process and protection against arbitrary or excessive data use. The 2026 Act’s success should ultimately be measured by how well it holds these interests together.
CONCLUSION
The National Identity Management Commission (Establishment) Act, 2026 represents a decisive break from the card-centred architecture of the 2007 Act. Its most important transformation is the elevation of NIMC from a principally registration-focused institution to a central actor in Nigeria’s digital trust and Digital Public Infrastructure architecture. By designating NIMC as the Root Certification Authority for the National Public Key Infrastructure and Digital Public Infrastructure, and by empowering secure and interoperable data exchange, the Act gives national identity a new institutional purpose.
But the Act’s significance does not end with DPI. Its recognition of digital and physical credentials, reinforcement of the NIN and “One Person, One Identity”, inclusive enrolment mechanisms, stronger privacy safeguards, decoupling of identity from benefit eligibility and citizenship, enhanced enforcement powers and restructured governance collectively demonstrate a comprehensive attempt to modernise identity management.
Ultimately, the success of this transformation will depend less on the ambition of the statutory text than on its implementation. The regulations must remain faithful to the Act’s protective language; NIMC must exercise its expanded powers proportionately and transparently; the data-protection regulator must supervise effectively; and the courts and legal profession must ensure that institutional power remains subject to the rule of law.
Farida Musah, Esq. LL.B., BL
Associate and Member,
Family, Succession and Wealth Management (FSW)