On 29 July we convened an X Space on strengthening the protection of citizens’ personal data and advancing big tech accountability. It drew 163 participants, and the discussion turned quickly to the law that now governs almost every Nigerian’s identity: the National Identity Management Commission Act 2026.
What the Act does
The Act introduces stronger safeguards around identity data, together with penalties for identity theft, cyber-related offences, and corrupt conduct by NIMC officials themselves. That last provision matters more than it might appear: a register is only as trustworthy as the people with administrative access to it.
Nonso Anyasi, a lawyer and doctoral researcher at the Open Universiteit in the Netherlands, addressed a misconception that had been circulating.
“The NIMC Act 2026 did not abolish the present means of identification. It only introduced stronger safeguards because almost everything about a Nigerian’s identity is linked to the National Identity Number.”
– Nonso Anyasi
That last clause is the whole argument for taking this law seriously. The National Identity Number is no longer one document among several. It is the thread that ties together a bank account, a SIM card, a pension, a passport and a tax record. A failure at the centre of that system is not a failure of one service; it is a failure of all of them at once.
How it was passed
Kehinde Adegboyega, Executive Director of the Human Rights Journalists Network Nigeria, raised the process rather than the provisions.
“The manner in which the NIMC Act 2026 was passed raises serious democratic concerns. Citizens, civil society organisations and other relevant stakeholders were not meaningfully consulted.”
– Kehinde Adegboyega, Human Rights Journalists Network Nigeria
There is a sharper version of the same point. The President signed the Act in June. The gazetted text has still not been published.
A law that has been signed but not published is binding on people who cannot read it. Every Nigerian is now subject to a statute governing their identity data, and no citizen, journalist or lawyer can quote its final wording with confidence. Publication is not an administrative afterthought at the end of the legislative process. It is the point at which a rule becomes something a person can actually obey, challenge, or hold an institution to.
Why we convened it
Consultation that happens after a law is passed is not consultation. But public understanding built after the fact is still worth something, because the Act will be interpreted, applied and litigated for years, and the people best placed to challenge a bad application are the people who know what the law says.
“The Foundation remains committed to creating platforms that encourage informed public engagement on digital rights and technology governance in Nigeria.”
– Festus Ogun, Foundation for Digital Justice
Privacy cannot be treated as the price of technological progress. A national identity system can be both effective and accountable, and the argument that it must be one or the other is usually made by whoever would rather not be audited.
We will keep convening these conversations, and we will keep pressing for the gazetted Act to be published.
The discussion was reported by Vanguard.
