Data Protection Bill

By Muhammad Mikail

On June 26, 2026, President Bola Ahmed Tinubu signed the National Identity Management Commission (NIMC) Act 2026 into law at the State House in Abuja, before an audience that included the trailblazer DG/CEO of the National Identity Management Commission, NIMC, Engr, Abisoye Coker-Odusote, the Senate President, the Deputy Speaker of the House, the Attorney General, the Minister of Interior, and a World Bank representative. The gathering was deliberately high-profile: the new law closes a 19-year gap in Nigeria’s identity system and reshapes how citizens, businesses, and the government will trust each other online. The Act officially repeals and replaces the NIMC Act of 2007, which had governed Nigeria’s identity system and remained untouched even before smartphones, biometric enrolment, or mobile banking became part of everyday Nigerian life.

For most citizens, the significance of a piece of legislation like this is easy to miss. And very few people will ever read its full text. This new Act 2026 determines how easily a young graduate opens a bank account, how a small trader secures a loan, how a Nigerian abroad renews a passport, and how confidently anyone can prove who they are, online or in person.

Why the Old Law Had to Go

When the original NIMC Act was passed in 2007, Nigeria had no national-scale biometric enrolment infrastructure and no meaningful digital economy to speak of. That changed dramatically over almost the two decades that followed: the National Identification Number (NIN) became mandatory for SIM registration, passport applications, bank account opening, and voter registration. As digital services multiplied, the risks also did. Identity theft, fraudulent NIN registrations, and the phishing of biometric data became live problems that the 2007 framework was never built to address. It had nothing to say about digital credentials, cybersecurity obligations, or how private companies overseeing NIN-linked data should behave. The new Act closes that gap. Thus far, officials and legal analysts point to four structural shifts at the heart of the reform:

NIMC becomes Nigeria’s digital trust authority. The single biggest change is the designation of NIMC as the Root Certification Authority for Nigeria’s National Public Key Infrastructure (PKI) and Digital Public Infrastructure (DPI). In practical terms, NIMC now controls the digital “keys” that make online transactions verifiable and trustworthy. 

“One Person, One Identity” is now the law. The NIN is formally established as Nigeria’s foundational identity credential, with the NIMC empowered to enable secure, interoperable data exchange among government agencies, financial institutions, and private-sector organisations that previously operated on fragmented, disconnected systems.

Data protection gets real teeth. The 2026 Act aligns NIMC’s practices with the Nigeria Data Protection Act (NDPA) and international privacy standards, meaning biometrics, addresses, and linked credentials must now be processed and stored under legally defined rules with NIMC committing to audit enrolment partners and third-party integrators more closely.

Penalties are sharper, and enforcement powers wider. Companies now face fines running into tens of millions of naira, while offences such as impersonation, multiple registration, and unauthorised access to identity data attract custodial sentences. NIMC’s investigative powers now extend to search, seizure, and, subject to judicial authorisation, data decryption.

The Commission’s board has also been reconstituted to include representatives from 14 government institutions, including INEC, the Nigeria Police Force, the DSS, the EFCC, the Central Bank of Nigeria, and the Office of the National Security Adviser. This signals that identity management is now of huge government concern.

The Implications for Identity Development

For nearly twenty years, Nigeria’s identity system evolved in a fragmented manner. NIN requirements were bolted agency by agency, without a unifying legal architecture. The 2026 Act gives that patchwork a single statutory backbone.

ID analysts rank Nigeria among Africa’s most mature digital identity ecosystems, alongside Kenya, Ethiopia, and South Africa. A legally grounded, PKI-backed identity system positions Nigeria for cross-border interoperability at a moment when West African economic integration is deepening, becoming a potential regional asset. The law also explicitly widens access for Nigerians in the diaspora, an acknowledgement that identity is a right and the attendant ID infrastructure needs to follow citizens wherever they live.

What It Means for Nigeria’s Digital Economy

The government have tied the Act directly to Nigeria’s ambition of building a one-trillion-dollar economy, arguing that a trusted, interoperable identity layer is a precondition for the digital services that ambition depends on. When banks, telecoms, insurers, and government agencies can all verify identity against a single authoritative source rather than duplicating know-your-customer processes, transaction costs fall, and fraud becomes harder to commit. Analysts following the reform expect it to strengthen the investment case for fintech expansion, e-commerce, and digital lending. These are sectors that all depend on being able to cheaply and quickly verify that the person on the other end of a transaction is real. Reduced duplication across agencies is also expected to improve the efficiency of public service delivery more broadly, from tax administration to social intervention programmes that need to verify beneficiaries accurately.

What It Means for the Everyday Nigerian and Legal Resident

Easier, wider access to services: With the NIN legally cemented as the reference point for passports, bank accounts, insurance, tax filing, and credit applications, NIMC has stated that citizens, including those in the diaspora, can expect easier and convenient access to identity-linked services, and stronger interoperability means fewer redundant registrations across agencies.

Stronger data protection: For the first time, there is a clear legal obligation governing how a Nigerian’s biometric and personal data must be managed, whether by NIMC itself or by any private company plugging into its verification infrastructure. 

Higher stakes, and higher expectations. The Act’s tougher penalties offer citizens greater protection against identity fraud. Also, to meet with President Tinubu’s directive of enrolling every Nigerian by the end of 2026 means NIMC would need to register more than three million people every month, DG/CEO NIMC said in an interview on Channels TV recently that NIMC is collaborating with partners under the World Bank-supported Nigeria Digital Identification for Development (NDID4D) Project to accelerate nationwide enrolment. This offers real hope of inclusion, particularly for rural and lower-income Nigerians who remain hardest to reach. 

The road ahead 

The NIMC Act 2026 is, by most independent accounts, a genuinely significant piece of reform. It closes a legal vacuum that persisted across four presidential administrations and a mobile internet revolution, the original drafters of the NIMC Act 2007 never anticipated. But the law itself only creates the scaffolding. The harder work of auditing enrolment partners, enforcing data-breach penalties, and reaching citizens outside the system remains.

Conclusively, I urge the NIMC, critical stakeholders and relevant agencies, organisations, CSOs and players in the ID ecosystem to support the NIMC and ensure the ACT of 2026 ultimately strengthens public trust, serves as a means to encourage nationwide enrolment for the NIN, and ensures the institutions enforcing it are themselves held to account. Ultimately, we must collectively ensure that all intended benefits, services, and access that the Act 2026 brings becomea lived reality for the average Nigerian and legal resident, and not another entry on the country’s lengthy list of good intentions.

Muhammad Mikail is a communications professional and writes from Abuja. He can be reached via muhammadnmikail.mm@gmail.com

By Muhammad Mikail

On the 12^th of June 2023, President Bola Ahmed Tinubu signed the Nigeria Data Protection Bill into law, setting the historic course for a new data-protected Nigeria. As a matter of fact, the bill was among the very first bills assented to by President Bola Ahmed Tinubu upon assumption of Office. This is no doubt a demonstration of Nigeria’s commitment to safeguarding digital privacy and building trust with global partners and stakeholders; a bold statement and alignment with the cliché’ ‘hit the ground running.’ 

The newly assented Data Protection Act 2023 provides a legal framework for the protection of personal information, safeguarding people’s basic rights and freedoms while supporting the establishment of ‘The Nigeria Data Protection Commission (NDPC)’ for the regulation of the processing of personal information and data. Hence, the law doesn’t only address privacy concerns but also sets the stage for responsible data usage, fostering a secure, trustworthy and progressive digital economic environment.

This also signifies the Federal Government of Nigeria’s full-proof commitment to the “Digital Transformation Strategy for Africa (2020-2030)” as commissioned by the African Union (AU). The overarching objective of the “Digital Transformation Strategy for Africa (2020-2030)” is for every country within the African continent “to harness digital technologies and innovation to transform African societies and economies to promote Africa’s integration, generate inclusive economic growth, stimulate job creation, break the digital divide, and eradicate poverty for the continent’s socio-economic development and ensure Africa’s ownership of modern tools of digital management.” The Nigeria Data Protection Commission will be a major player in achieving this lofty goal.

At one point, there was a lot of scepticism by development partners, international financial institutions, critical stakeholders in the digital economy and even potential investors about Nigeria’s lack of data protection legislation.       

Addressing these concerns, the Federal Government of Nigeria, under former President Muhammadu Buhari, established the Nigeria Data Protection Bureau (NDPB) in 2022 as the regulatory institution responsible for ensuring that people’s personal information is kept private and safe when used for ‘digital things’ with Dr Vincent Olatunji as the National Commissioner. However, the Bureau lacked a law establishing it and giving it the robust legal framework required for a full-fledged agency of government to adequately address issues bordering on the security and privacy of data in Nigeria.

In January 2023, the Federal Executive Council (FEC) approved the Nigeria Data Protection Bill presented by former Hon. Minister of Communication and Digital Economy, Prof. Isa Ali Ibrahim Pantami, for transmission to the National Assembly for consideration.      

The then Nigeria Data Protection Bureau, NDPB, now NDPC, led by the National Commissioner, Dr Vincent Olatunji, in collaboration with the Nigeria Digital Identification for Development Project (NDID4D), worked with critical stakeholders, Ministries Departments and Agencies, captains of industries and policymakers perfecting the bill. 

A Focus Group Discussion, national policy dialogue and validation workshop was held to present the draft bill to stakeholders, the 9^th National Assembly, and the Federal Ministry of Justice for their buy-in, comments, criticism, and suggestions to improve the bill.  Prior to that, Nigeria had no policy instrument that focused on supporting data privacy and data protection. 

Described as one of the most forward-thinking Acts across the African data ecospheres, the Nigeria Data Protection Act recognises innovations, blockchains, Artificial Intelligence and robotics. The Act also fosters an environment where companies prioritise robust cybersecurity measures and protect sensitive personal information from unauthorised access.

Furthermore, the law empowers users by ensuring that their data is handled responsibly and ethically since, as a fact, the law emphasises informed consent, which enables users to make conscious decisions regarding the use of their data. With this regulation, organisations are bound by law to promptly adapt their practices to comply with the new data protection standards. This brings a balance between leveraging data for business growth and respecting individuals’ privacy rights.

In terms of job creation, Dr. Vincent Olatunji, the National Commissioner of the Nigeria Data Protection Commission, NPDC launched the Nigeria Data Protection Strategic Roadmap and Action Plan, NDP-SRAP 2023-2027 on the 13^th of December 2023, in Abuja. The action plan is expected to create about 500,000 jobs and generate more than N125 billion in revenue.

Dr Vincent said in an interview that the NDP-SRAP 2023-2027 is in conformity with President Bola Ahmed Tinubu’s renewed hope agenda. He said, “Part of the ‘Renewed Hope Agenda’ of President Bola Ahmed Tinubu’s administration is to create about two million jobs in the digital economy sector. The data protection sector alone could create more than 500,000 jobs.”

According to the National Commissioner, “The NDP-SRAP comprises interlinked initiatives and activities like job, wealth creation, human capital development, revenue generation, foundational initiatives for the digital economy and enhancing Nigeria’s global reputation. These activities are expected to create about 500,000 jobs, generate revenue of more than N125 billion and expand the sector within the lifespan of this roadmap”.

In the same vein, the former Minister of Communication and Digital Economy, Prof. Isa Ali Ibrahim Pantami, was quoted in an interview to have said that “in two years of the implementation of the Nigeria Data Protection Regulation, NDPR, a novel sub-sector of the economy was created, 7,680 Nigerians were employed. Nigeria was appointed as the Vice Chair of the Data Protection Laws Harmonization Working Group at the African Union (AU) and was the only country in Africa to publish a data protection report in two years.

According to the DG/CEO of the National Identity Management Commission, “integrated identity is the backbone of e-governance initiatives as it provides an enabling environment for key government programmes of social safety net, financial inclusion, as well as for companies that want to provide innovative products and services to people.  She said, “An integrated identity system will strengthen the government’s fiscal management, promote good governance and transparency through inclusivity and social equality, as it ensures that marginalized and vulnerable populations are not excluded from government services.”

The Nigeria Data Protection Act is an enabler of inclusive identity issuance and management and a precursor for the growth, integration, and stability of Nigeria’s digital identity system. It is part of efforts to issue legal digital identities to 99.9% of people in Africa as part of a civil registration process by 2030. 

In this vein, the Act serves as the launch pad for the government’s efforts in building inclusive digital skills and human capacity across the digital sciences, judiciary, and education, both technical and vocational, to lead and power digital transformation, including coding, programming, analysis, security, blockchain, machine learning, artificial intelligence, robotics, engineering, innovation, entrepreneurship, and technology policy & regulation. This is evident in the recent launch of the 3 Million Technical Talent (3MTT) programme by the Hon. Minister for Communication, Innovation and Digital Economy, Mr Bosun Tijjani. The programme is aimed at building Nigeria’s technical talent backbone, powering her digital economy and positioning Nigeria as a net talent exporter the first phase of the programme, executed in collaboration with NITDA, is set to involve multiple stakeholders, including fellows, training providers, partners, and placement organisations.

Consequently, the nation hopes to witness robust digital economic growth, especially with the growth of digital platforms. These platforms are essential elements of digital infrastructure and can serve people, businesses, and government agencies in all aspects of life, including healthcare, education, commerce, transportation, and public benefits. Digital platforms serve or enable other products or services. For the people who use these platforms to receive their monthly pensions, securely login to a government e-services portal, pay their utility bills, submit a complaint, access public information, or find a person to rent their car, these platforms can provide a seamless service delivery experience that increases user convenience, savings, and agency. For governments, digital platforms can increase the efficiency and effectiveness of core functions and services, reduce unnecessary duplication of systems, and combat fraud.

Finally, as data subjects and responsible citizens, we must stay informed about data protection laws; demand transparency from organisations that collect our data and support NPDCs initiatives to sustain and promote international cooperation on data protection, its continuous improvement, and efforts to secure our digital economic future.

Muhammad Mikail writes from Abuja and can be reached via muhammadnmikail.mm@gmail.com.