NigeriaNational Identity Management Commission (Establishment) Act, 2026, access to the National Identity Database and mandatory use of the National Identification Number
National Identity Management Commission (Establishment) Act, 2026 (Act No. 3 of 2026), ss. 24-27
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- National Identity Management Commission
- Obligation class
- Access restriction, Consent, Prohibition, Security
What it requires
- Do not access the data or information held in the National Identity Database for a registered person unless the registered person has given and not withdrawn consent to the disclosure, or the disclosure is necessary for compliance with a legal obligation you are subject to, for a task carried out in the public interest or in the exercise of official authority vested in you, for the prevention, detection, investigation, prosecution or punishment of an offence, or for the preparation or conduct of proceedings before a court (section 24(2)).
- Where you are provided with registered information in connection with a particular purpose, use it for that purpose only, unless the registered person consents to the other use, the other use is authorised or required by law, the other purpose is directly related to the purpose for which the information was collected, or the information is used in a form in which the registered person is not identified or for statistical or research purposes without being published in a form that can reasonably be expected to identify the person (section 24(6)).
- Where you use or disclose registered information, implement appropriate technical and organisational measures to ensure that the use or disclosure does not harm the rights and freedom of the relevant registered person (section 24(7)).
- State in each request for access to registered information the purpose for which it is required, the period of retention of the information, the recipient, and the security and confidential modalities for disposing of the information once it is no longer required (section 24(9)).
- Where you are an agent the Commission licenses to carry out authentication and verification on its behalf, store any registered information securely and perform only the services the Act and the Commission's directions provide for (section 25(1)).
- Where you facilitate, or provide the service for, a transaction listed in section 26(1), among them financial transactions, the opening of bank accounts, the purchase of insurance policies, registration for telecommunications services, consumer credit transactions and the payment of taxes, verify the identity of the parties involved in the transaction using the National Identity Number provided (section 26(4)).
- Do not, without lawful authorisation by the Commission, intentionally access or secure access to the National Identity Database, download, copy or extract data from it, reveal, share, use or display information contained within it, or use or tamper with its data to modify information relating to a registered person or to discover any information (section 27(1)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 27(2) provides, on conviction of a natural person who contravenes section 27(1), a fine or imprisonment for a term of at least five years, and, for a body corporate, a fine, with a further fine or imprisonment for a term of at least five years for every principal officer of the body corporate.
What this law does
Section 2 applies the Act to the registration of registrable persons within and outside Nigeria and to the management and operation of the National Identity Database. Section 24(1) requires the National Identity Management Commission to comply with the Nigeria Data Protection Act and best practices in data protection and privacy in its operation and management of the National Identity Database.
Section 24(2) bars a person from access to the data or information in the National Identity Database for a registered person except where the registered person has given and not withdrawn consent to the disclosure, or where disclosure is necessary for one of the purposes paragraph (b) lists, the first being compliance with a legal obligation to which the requesting person or body corporate is subject.
Section 24(2)(b)(ii) to (iv) adds the performance of a task carried out in the public interest or in the exercise of official authority vested in the requesting person or body corporate, the prevention, detection, investigation, prosecution or punishment of an offence, and the preparation or conduct of proceedings before a court.
Section 24(6) bars a person who is provided with registered information in connection with a particular purpose from using it for any other purpose unless one of the exceptions the subsection lists applies, the first being that the registered person consents to the use for that other purpose.
Section 24(7) requires a person who uses or discloses registered information to implement appropriate technical and organisational measures to ensure that the use or disclosure does not harm the rights and freedom of the relevant registered person.
Section 24(9) requires each request for access to registered information to state the purpose for which the information is required, the period of retention of the information, the recipient of the information, and the security and confidential modalities for the disposal of the information once it is no longer required.
Section 25(1) lets the Commission license agents to carry out authentication and verification on its behalf, provided those agents store any registered information securely and only perform the services under the Act and any directions the Commission provides. Section 25(3) bars the Commission from collecting, keeping or maintaining any information about the purpose of authentication, whether by itself, through an entity under its control or through its agents.
Section 26(1) requires the National Identification Number to be presented for verifying the identity of the registered person for listed transactions, among them financial transactions and the opening of bank accounts. Section 26(1) also lists the purchase of insurance policies and registration for telecommunications services among those transactions.
Section 26(4) requires a person facilitating any of the listed transactions or providing the service to verify the identity of the parties involved in the transaction, using the National Identity Number provided. Section 27(1) makes it an offence for a person, without lawful authorisation by the Commission, intentionally to access or secure access to the Database or to download, copy or extract data from it.
Section 32 lets the Commission investigate any complaint referred to it, and conduct investigations on its own motion where it has reasonable cause to believe that there might have been instances of non-compliance with the Act.
When LexLint raises it
When your app profile says your app is a bank, is an insurer, is a lender, processes personal data or provides telecom services.
Back to the example · Lint your app
Page updated .