Nigeria's identity law raises questions over who regulates digital signatures

In a small business in Lagos, Adeboye Adegoke is worried. As a policy expert, he knows that Nigeria's new identity law and the long-awaited digital economy bill could create a web of confusion for businesses and government agencies alike. "Ideally, this should have been spotted by the legal drafting unit at the National Assembly," he said, "but with what happened with the tax bill, I'm not surprised." For Adeboye and others like him, the stakes are high. If the two frameworks create overlapping rules, it could slow the rollout of secure digital services, affecting real people like Mrs. Ifeoma Onyekachi, a small business owner who relies on digital transactions to sell her goods.

The NIMC Act 2026, which replaced the 2007 Act, has designated the National Identity Management Commission (NIMC) as Nigeria's Root Certification Authority (Root CA). This puts NIMC at the centre of Nigeria's digital trust infrastructure, with responsibility for issuing root digital certificates, verifying electronic identities, and overseeing the trust framework for digital signatures linked to the National Identification Number (NIN). However, the National Digital Economy and E-Governance Bill focuses on the legal validity of electronic signatures, establishing standards for digital signatures, including identity verification, sole control by the signer, data integrity, and the ability to detect subsequent changes. The problem is that both laws have overlapping mandates, creating uncertainty over who ultimately controls key parts of Nigeria's digital trust infrastructure.

The National Information Technology Development Agency (NITDA), Nigeria's tech regulator, is empowered to regulate and accredit electronic signature Certification Authorities under the E-Governance Bill. However, this creates a potential conflict with NIMC, which is now the Root Certification Authority under the NIMC Act. This conflict could lead to a situation where government agencies, regulators, banks, and technology companies have to comply with overlapping rules, slowing the rollout of secure digital services. As Adeboye Adegoke noted, this is a problem that could have been spotted by the legal drafting unit at the National Assembly, but it seems to be a case of "what happened with the tax bill."

For Mrs. Ifeoma Onyekachi, a small business owner who relies on digital transactions to sell her goods, the uncertainty over digital signatures and identity verification is a major concern. If the two frameworks create overlapping rules, it could slow the rollout of secure digital services, affecting her business and others like hers. "I rely on digital transactions to sell my goods," she said. "If the rules are unclear, it could be a problem for me and my business." The impact of this uncertainty could be felt across the country, with businesses and government agencies struggling to comply with overlapping rules.

Given the overlapping mandates of the two laws, it is predictable that government agencies, regulators, banks, and technology companies will have to comply with unclear rules, slowing the rollout of secure digital services. As Adeboye Adegoke noted, this is a problem that could have been spotted by the legal drafting unit at the National Assembly, but it seems to be a case of "what happened with the tax bill." In the end, the uncertainty over digital signatures and identity verification could create a web of confusion that affects real people like Mrs. Ifeoma Onyekachi and her business.

The National Assembly must take a closer look at the NIMC Act and the Digital Economy Bill to ensure that there is clear alignment between the two laws. This is a matter of urgency, given the importance of digital services to businesses and government agencies. As Adeboye Adegoke noted, "the National Assembly will have to take a closer look and do the needful." In the meantime, businesses and government agencies will have to navigate a web of unclear rules, slowing the rollout of secure digital services.