The National Identity Management Commission (Establishment) Act, 2026 — Key New Provisions

INTRODUCTION

The National Identity Management Commission (Establishment) Act, 2026 (“the Act”)¹ repeals and replaces the National Identity Management Commission Act, No. 23, 2007. The Act is far from a routine re-enactment; it fundamentally restructures Nigeria’s identity management regime by repositioning the National Identity Management Commission (“NIMC” or “the Commission”) from a registration body to the institution responsible for Nigeria’s digital identity and Digital Public Infrastructure (‘’DPI’’) ecosystem. The Act also adopts an expressly inclusive and data protection approach to identity management. The key new provisions are highlighted below.

INCLUSIVE REGISTRATION REGIME

The Act introduces a more inclusive registration framework by expanding how eligible persons may enrol for a National Identification Number (‘’NIN’’). Registration may now take place within and outside Nigeria.²

Applicants who are unable to provide a government-issued identification document at the point of enrolment may instead be identified through an alternative verification process. In such cases, the Commission may require a registered adult relative to identify the applicant under oath or permit another prescribed person referred to as an "identifier" to verify the applicant's identity. The Commission is also required to maintain a register of identifiers.³

The Act also directs the Commission to take special measures to enrol and issue NINs to persons who do not have any permanent place of residence. Although the Act does not prescribe what those measures will entail, these provisions are designed to close the documentation gap that has historically excluded undocumented and vulnerable populations, as well as the diaspora.

DIGITAL IDENTITY AND DIGITAL PUBLIC INFRASTRUCTURE

The most significant reform is the expansion of the Commission's mandate beyond identity registration to the governance of Nigeria's digital identity and DPI.

The Act designates the Commission as the root certification authority and issuing authority for the National Public Key Infrastructure and DPI. It also serves as the national repository for biometric data and, in collaboration with relevant agencies, is responsible for the registration of births and deaths.⁴. The Commission may harmonise and integrate existing identification databases in government agencies into the Database, establish and maintain secure communication links with any relevant identity-related database or agency, and establish a framework for secure and efficient data exchange among government agencies, private sector organisations, and other entities. It may also license persons or corporate bodies to enrol registrable persons within and outside Nigeria, and prescribe administrative sanctions for non-compliance with its standard operating procedures.⁵

Collectively, these reforms extend the Commission’s role beyond registering individuals. They give it responsibility for the technical and data sharing architecture that other institutions, government agencies and private organisations will rely on to verify identity.

DATA PROTECTION AND PRIVACY FRAMEWORK

The Act introduces robust privacy safeguards that were largely absent under the repealed 2007 regime. It expressly requires that the National Identity Database must be operated in compliance with the Nigeria Data Protection Act, 2023⁶, and registered information may only be disclosed with the data subject's consent or where disclosure is authorised on specified public-interest, law-enforcement or court-ordered grounds⁷.

Notably, the Act incorporates important privacy by design principles. It provides that the NIN must bear no relation to the attributes or identity of the holder,⁸ thereby preventing the NIN from revealing personal characteristics. In addition, Identity credentials may contain only prescribed particulars and no other particulars,⁹ and the Commission is barred from keeping any record of the purpose of authentication¹⁰ helping to limit profiling and unnecessary monitoring of authentication activities.

MANDATORY USE OF THE NIN AND ITS LIMITS

The Act¹¹makes the NIN mandatory for a wide range of transactions, including the issuance of international passports and voter’s cards, government subsidies and benefits, banking, insurance, telecommunications registration, land dealings, tax administration and consumer credit.

Crucially, the Act clarifies that proof of identity does not constitute proof of eligibility for any benefit or service.¹² It further provides that the issuance of an NIN or identity credential is not an incontrovertible proof of citizenship.¹³ These provisions clearly distinguish identity verification from eligibility for benefits and from the determination of nationality.

GOVERNANCE, OFFENCES AND ENFORCEMENT

Governance is restructured around a Governing Board drawing in fourteen public institutions, and the Director-General’s appointment now requires Senate confirmation.¹⁴. The enforcement regime is also significantly strengthened. Unauthorised access to the National Identity Database attracts penalties of at least ₦10 million or five years imprisonment for individuals and at least ₦20 million for corporate bodies, with comparable sanctions prescribed for identity fraud and impersonation. The Act also criminalises overcharging at the point of enrolment or verification and confers the Commission with investigation, search, seizure and arrest powers.¹⁵

IMPLICATIONS FOR STAKEHOLDERS

Regulated entities that rely on the NIN such as banks, telecommunications operators and insurers should review their customer onboarding and identity verification processes to reflect the intentions of the Act. Organisations handling registered information must align their consent, disclosure and security practices with both the Act and the NDPA. Enrolment and verification agents face new licensing, storage and fee-conduct obligations, while government agencies should prepare to migrate legacy databases into the National Identity Database under NIMC’s coordination.

CONCLUSION

By combining an inclusive registration mandate with a DPI role and NDPA-anchored privacy safeguards, the Act moves Nigeria from a fragmented identity registry toward a harmonised, digital identity ecosystem. For operators across the financial, telecommunications, technology and public sectors, the priority is to align systems, controls and commercial arrangements with the new regime.

Footnotes

1. .National Identity Management Commission (Establishment) Act, 2026, repealing the National Identity Management Commission Act, No. 23, 2007.

2. Section 2 Ibid.

3. Section 18 Ibid.

4. Section 7 Ibid.

5. Section 8 Ibid.

6. Nigeria Data Protection Act, No. 23, 2023.

7. Section 24 Ibid.

8. Section 18(10) Ibid.

9. Section 20 Ibid.

10. Section 25(3) Ibid.

11. Section 26 Ibid.

12. Section 26(2) Ibid.

13. Section 26(3) Ibid.

14. Section 9 Ibid.

15. Section 29-33 Ibid.