Nigeria’s new identity law turns NIMC into the country’s digital trust authority

For nearly two decades, Nigeria’s National Identity Number (NIN) has primarily served as a means of verifying identity for services such as opening bank accounts, SIM registration, and access to government programmes. 

The newly signed National Identity Management Commission (NIMC) Act, 2026, exclusively obtained by TechCabal, fundamentally changes that. Through nine major reforms, the law expands  NIMC’s statutory responsibilities to include digital identity, Public Key Infrastructure, Digital Public Infrastructure and functions related to securing digital identities.

The new law, which began its journey on  March 19, 2024, at the National Assembly,  was signed into law by President Bola Tinubu on June 26, 2026. It repeals the 2007 NIMC law and introduces the most significant overhaul of Nigeria’s identity management system since NIMC  was established. 

“It establishes a modern, forward-looking legal framework that aligns Nigeria’s identity ecosystem with global best practices, emerging technologies and the demands of a rapidly evolving digital economy,” Kayode Adegoke, NIMC’s Head of Corporate Communications, said in a statement announcing the law.

The new law gives NIMC legal responsibility for securing digital identities, protecting sensitive personal data, managing the country’s Public Key Infrastructure (PKI), and providing legal support for Nigeria’s Digital Public Infrastructure (DPI). 

DPI is the digital backbone that enables secure digital transactions among individuals, businesses, and government agencies. It combines trusted digital identity through the NIN, payment infrastructure that enables money to move seamlessly across banks and fintech platforms, and Public Key Infrastructure (PKI), the cryptographic security system that verifies identities, encrypts data, and protects online transactions. 

These systems make it possible to open a bank account remotely, access government services, sign documents digitally, or transfer money securely within seconds.

“The inclusion of ‘digital identity’ as a statutory objective aligns Nigerian law with international frameworks such as the World Bank’s Identification for Development (ID4D) initiative and the Principles on Identification for Sustainable Development,” the law stated. 

From identity cards to digital identity

A major weakness of the 2007 law was its reliance on the General Multi-Purpose Card (GMPC), a physical identity card that served as the basis of Nigeria’s identity system. As NIN enrolment grew, the model struggled to keep up. Printing delays, supply chain disruptions, and rising production costs left millions of Nigerians waiting years to receive their identity cards, even after successfully registering.

The new law shifts from that card-based approach. Instead, it adopts a technology-neutral identity framework that allows Nigerians to prove their identity using both physical and digital credentials.

Identity can now be delivered through smartphone apps, QR codes, biometric authentication, digital wallets, and other emerging technologies. 

The approach is consistent with digital identity systems increasingly adopted in several jurisdictions. 

Several countries have already made this transition. India’s Aadhaar enables biometric authentication for banking and public services.  Estonia introduced Mobile-ID in 2007, which allows citizens to vote, sign legally binding documents, among other things. Singapore’s  Singpass, launched in 2003 and upgraded to a mobile-first digital identity platform in 2018, uses facial biometrics and liveness detection to verify users without requiring a physical identity card. Brazil launched the Gov.br platform in 2019, which integrates dozens of federal and state identity systems into a single digital identity accessible through a smartphone app.

In Africa, Kenya initiated a complete overhaul of its identity architecture in November 2023 with the launch of Maisha Namba, as part of a transition away from its legacy, paper-based system. Rather than prioritising plastic, the government integrated this new identity ecosystem into the Maisha Digital ID smartphone app, which generates secure, dynamic QR codes that change periodically to prevent identity theft.

Similarly, Togo gained global recognition for its digital-first identity system during the COVID-19 pandemic in April 2020, when it launched the Novissi platform. Built in collaboration with the World Bank’s ID4D initiative, this technology-neutral biometric framework allowed Togo to bypass traditional distribution bottlenecks and execute rapid, contactless social welfare payouts directly to its citizens.

Identity becomes digital infrastructure

Perhaps one of the most significant changes in the new law is one most Nigerians will never see.

The Act designates NIMC as Nigeria’s Root Certification Authority for the National Public Key Infrastructure (PKI) and Digital Public Infrastructure (DPI), making it the country’s highest trusted digital authority. NIMC will issue and manage the cryptographic certificates, digital signatures, and authentication systems that verify identities and secure online transactions across government and private-sector platforms.

Although the terminology is highly technical, the impact is far-reaching. Public Key Infrastructure is the trust layer of the digital economy. It powers secure logins, digital signatures, encryption, and identity verification, ensuring that online transactions are authentic and protected from fraud or tampering.

Under the Act, NIMC will oversee Nigeria’s Root Certification Authority and the national Public Key Infrastructure, making it responsible for issuing and managing the digital trust framework used to authenticate identities, secure digital communications, and support electronic transactions. 

Recognising this reality, the new law significantly strengthens NIMC’s enforcement powers.

Unlike the previous Act, which largely focused on administration, the 2026 law grants the commission investigative powers, including court-authorised search, seizure, and arrest powers against illegal enrolment centres, identity fraud syndicates, and data racketeers.

The penalties are now steeper.

Unauthorised access to the National Identity Database now carries a minimum punishment of five years’ imprisonment or a ₦10 million ($7,237) fine for individuals.

For companies, fines rise to at least ₦20 million ($14,474), while responsible executives may also face personal criminal liability.

Attempting multiple registrations or impersonating another person’s identity now attracts similarly severe penalties.

Data privacy finally enters Nigeria’s identity law

When Nigeria enacted the original NIMC Act in 2007, the country had no comprehensive data protection law. Nearly two decades later, as digital identities have become repositories of highly sensitive personal information, the 2026 Act brings NIMC squarely under the Nigeria Data Protection Act (NDPA), creating a clear legal framework for how identity data is collected, stored, processed and shared.

The law adopts a consent-first approach. In most cases, third parties can only access information in the National Identity Database with the individual’s permission. The only exceptions are narrowly defined, including High Court orders, criminal investigations, and matters of public interest.

The Act also introduces new transparency obligations. At the point of enrolment, NIMC must inform citizens how their data will be used, who it may be shared with, and which department is responsible for protecting it. It is the first time privacy, consent, and accountability have been explicitly embedded in Nigeria’s identity law.

The Act also tackles one of Nigeria’s biggest identity challenges: exclusion. It requires NIMC to create specialised enrolment systems for vulnerable and underserved populations, including people without permanent addresses, ensuring they are not locked out of essential services as digital identity becomes increasingly central to accessing healthcare, financial services, and government social programmes.

By embedding stronger privacy protections and expanding identity access for underserved populations, the Act lays the legal foundation for a more secure and inclusive identity system. Its impact will ultimately be determined by implementation.

True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.