NIMC Act 2026: What you need to know as Nigeria finally rewrites its identity law

On Friday, June 26, President Bola Ahmed Tinubu signed a piece of legislation that most Nigerians will never read but will quietly shape many of their interactions with government agencies, banks, hospitals, and telecom providers for years to come. The National Identity Management Commission (NIMC) Act 2026 replaces a law that was adopted in 2007, when the iPhone had not yet launched, Nigeria had no biometric database at scale, and the idea of linking your identity number to a bank account sounded like science fiction.

When the original NIMC Act passed in 2007, Nigeria had no e-ID enrolment infrastructure, no biometric database at scale, and no digital economy to speak of. By 2025, things looked very different; the NIN had become mandatory for SIM registration, passport applications, bank account opening, and voter registration. The old law, unchanged through all of that, had almost nothing to say about digital credentials, cybersecurity obligations, or how private companies were supposed to handle your NIN-linked data.

That gap was not just inconvenient but dangerous. Threats multiplied: identity theft, fraudulent NIN registrations, phishing of biometric data, and enrolment agents who registered non-Nigerians for money. A law written in the year Nokia was still the world’s dominant phone brand was being asked to govern a country of over 200 million people as it navigated a 21st-century digital economy. The results were predictable.

What the new law actually does

Think of the NIMC Act 2026 in four parts. First, it gives NIMC real authority over Nigeria’s digital infrastructure. The legislation designates NIMC as the Root Certification Authority for Nigeria’s National Public Key Infrastructure and Digital Public Infrastructure, effectively placing the Commission at the centre of the country’s digital identity, authentication, and electronic trust architecture. In plain terms, NIMC is now the institution that vouches for the digital legitimacy of transactions in Nigeria, playing the same role a central bank plays for money, but for identity.

Second, it locks in “One Person, One Identity” as a governing principle. The new law reinforces the National Identification Number as Nigeria’s foundational identity credential under the principle of “one person, one identity” while empowering NIMC to facilitate secure and seamless data exchange among government agencies, financial institutions, and private-sector entities. By implication, that data exchange provision simply means your records can now travel securely between government ministries, your bank, and a private hospital, in theory, without you having to prove who you are from scratch at each door.

Third, it takes data protection seriously in a way the old law never did. The Act strictly prohibits access, use beyond stated purposes, or acquisition of personal information without explicit consent or adherence to established legal procedures. President Tinubu was direct at the signing ceremony: “I will not allow the data of Nigerians to be treated carelessly.” Whether enforcement matches that rhetoric is another matter, but the legal foundation is now there.

Fourth, it gets punitive. Corporate organisations found in violation face potential fines of up to ₦20 million, while individuals convicted of offences such as unauthorised access, multiple registration, or impersonation risk a minimum of five years’ imprisonment. The law also grants NIMC court-authorised investigative powers, including the authority to conduct searches, seize evidence, and decrypt data in connection with identity fraud. This is no longer a system that wags a finger; it now has a fist.

Buried beneath the security language is something genuinely progressive. The law introduces an innovative identifier system for vulnerable persons and mandates special measures to facilitate the enrolment of underserved populations, including individuals without permanent residences. In a country where NIN enrolment has crossed 127 million but remains significantly below Nigeria’s estimated population of over 230 million people, with women and rural communities harder to reach, this provision is the real test of whether this law delivers on its promise or becomes another well-written document that benefits mainly those who already have access to everything.

Why NIMC Act 2026 matters beyond Nigeria

A recent report by global secure identity firm IN Groupe ranks Nigeria among Africa’s most mature digital identity ecosystems, alongside Kenya, Ethiopia, and South Africa. The 2026 Act consolidates that position and, crucially, sets up the architecture for cross-border interoperability. As West Africa deepens economic integration, a trusted, legally grounded identity system is not just a domestic asset; it is a regional one.

There is also a security dimension that officials have been relatively candid about. The Interior Minister revealed that integrating the NIMC database with government digital platforms had already enabled security agencies to identify and apprehend suspected terrorist operatives upon their arrival in the country. Identity infrastructure, it turns out, is also counterterrorism infrastructure.

But scepticism remains; Nigeria has a documented history of sound legislation that stalls at the implementation stage. The hard work now is not in the statute but in the audits of enrolment partners, the enforcement actions against data breaches, and the deliberate outreach to citizens who remain outside the system. 

To achieve its target of 180 million enrolments by the end of 2026, NIMC would need to register more than three million people every month, a pace that presents significant operational challenges.

Also read: NIMC launches WhatsApp, live chat channels for faster NIN support

The NIMC Act 2026 is genuinely significant. It closes a legal gap that had been left open through four presidential administrations, a mobile internet revolution, and a global pandemic. It gives Nigeria the legal scaffolding to build a digital economy that can verify, protect, and include its citizens.