Nigeria's National Identity Management Commission (NIMC) Act 2026 Signed

President Bola Tinubu has signed the National Identity Management Commission (NIMC) Act 2026 into law, marking a significant overhaul of Nigeria’s identity management framework. This new legislation repeals the NIMC Act of 2007, aiming to strengthen national security, enhance public service delivery, and accelerate digital transformation through a more robust and secure digital identity ecosystem. A key feature is the reinforcement of the National Identification Number (NIN) as the foundational identity credential, coupled with significantly enhanced data protection safeguards aligned with the Nigeria Data Protection Act (NDPA) 2023. The Act also introduces stiffer penalties for identity-related offences and expands the mandatory use of the NIN across various public and private transactions, with the Minister of Interior noting its immediate impact on national security through integrated database intelligence.

In a landmark development for Nigeria's digital future and national security, President Bola Tinubu on Friday, June 26, 2026, assented to the National Identity Management Commission (NIMC) Act 2026. This legislative milestone repeals and replaces the nearly two-decade-old NIMC Act of 2007, ushering in a modern, forward-looking legal framework designed to align Nigeria's identity ecosystem with global best practices and the demands of a rapidly evolving digital economy.

The new Act is poised to strengthen Nigeria’s identity management system, enhance national security, improve public service delivery, and accelerate the country’s digital transformation. The Federal Government has emphasized that a strengthened national identity system is crucial for economic planning, border control, and combating crime, with the Minister of Interior citing recent successes in apprehending terror suspects due to an integrated identity database. This article will delve into the core provisions of the NIMC Act 2026, its interplay with existing data protection legislation, and the critical implications for legal practitioners and the broader Nigerian society.

The National Identity Management Commission (NIMC) was established by the NIMC Act No. 23 of 2007, with the mandate to establish, own, operate, maintain, and manage the National Identity Database in Nigeria. Its primary functions included registering citizens and legal residents, assigning a unique National Identification Number (NIN), and issuing General Multi-Purpose Cards. The NIN was conceived as a foundational identity credential, intended to connect all records about an individual's identity.

Over the years, the mandatory linkage of NIN with Subscriber Identification Module (SIM) cards became a prominent policy aimed at enhancing national security and mitigating identity fraud. However, the digital landscape evolved rapidly, exposing the limitations of the 2007 Act in addressing emerging technological advancements, cybersecurity threats, and the growing demand for robust data protection. This necessitated a more comprehensive and enforceable legal framework. Complementing this, the Nigeria Data Protection Act (NDPA) 2023, signed into law on June 12, 2023, established the Nigeria Data Protection Commission (NDPC) and provided a comprehensive legal framework for safeguarding personal information, thereby setting the stage for a harmonized approach to identity and data management.

The NIMC Act 2026 represents a significant legislative upgrade, repealing and replacing its 2007 predecessor to introduce several key innovations. Foremost among these is the strengthening of NIMC's role as the statutory authority responsible for the national identity management system, firmly establishing the National Identification Number (NIN) as the country's foundational identity credential under the principle of "One Person, One Identity." A defining feature is the designation of NIMC as the Root Certification Authority for Nigeria's National Public Key Infrastructure (PKI) and Digital Public Infrastructure (DPI), positioning the Commission at the centre of Nigeria's digital trust architecture for secure digital identity, authentication, and electronic trust services.

Crucially, the new Act introduces robust data protection and privacy safeguards, explicitly aligning with the Nigeria Data Protection Act (NDPA) 2023 and international best practices. It mandates that personal information cannot be accessed without the data subject's consent, except through proper legal channels, thereby reinforcing citizens' constitutional right to privacy. This provision is particularly pertinent given past concerns and judicial pronouncements on data privacy, such as the Federal High Court's affirmation of data privacy rights in *Incorporated Trustees of Paradigm Initiative for Information Technology (PIIT) & Sarah Solomon-Eseh v National Identity Management Commission & Anor.* (2019), which directed NIMC to improve its data privacy and security systems. Similarly, the Court of Appeal in *Incorporated Trustees of Digital Rights Lawyers v. National Identity Management Commission* (2021) underscored the relationship between the right to privacy and data protection.

The Act also significantly enhances penalties for identity-related offences, introducing stiffer sanctions for multiple registrations, identity theft, impersonation, and fraud. Corporate bodies face fines of up to N20 million, while individuals could face a minimum of five years' imprisonment for unauthorised access, multiple registration, and impersonation. Furthermore, the mandatory use of the NIN has been expanded to a wider range of public and private transactions, including passport applications, voter registration, bank accounts, land transactions, telecommunications services, pensions, insurance, tax payments, consumer credit, and access to government services. The legislation also formally recognizes both physical and digital identity credentials, all securely linked to an individual's NIN, and introduces special measures to ensure vulnerable and underserved populations, including those without permanent residences, can access identity registration services.

The Minister of Interior's statement regarding the arrest of terror suspects facilitated by the integrated database underscores the Act's immediate security implications. This highlights the dual objective of the legislation: to foster a secure digital identity ecosystem for economic growth and public service, while simultaneously serving as a critical tool for national security. The explicit alignment with the NDPA 2023 is crucial, as it provides a comprehensive framework for balancing these objectives, ensuring that the collection and use of personal data for security purposes are conducted within established legal and ethical boundaries, addressing previous vulnerabilities related to data breaches and unauthorized access.

The NIMC Act 2026 marks a transformative era for identity management in Nigeria, establishing a robust legal framework that is both modern and responsive to the nation's digital aspirations and security challenges. For legal practitioners, this new legislation introduces a heightened landscape of compliance obligations and potential litigation. Businesses and government agencies will need to meticulously review and update their data processing practices to ensure strict adherence to the expanded mandatory use of NIN and the strengthened data protection provisions, which are now firmly anchored in both the NIMC Act 2026 and the Nigeria Data Protection Act 2023.

Practitioners must advise clients on the implications of the significantly increased penalties for identity-related offences and the need for robust internal controls to prevent data breaches and misuse. The ongoing implementation of the Act, particularly the development of subsidiary regulations and guidelines, will be critical to watch. The delicate balance between leveraging an integrated identity database for national security and safeguarding individual privacy rights will remain a key area of focus. Legal professionals are therefore urged to thoroughly familiarize themselves with this comprehensive new law and its intersection with the broader data protection regime to effectively guide their clients through Nigeria's evolving digital identity landscape.