Nigeria’s rapid expansion of digital public infrastructure (DPI), including its national digital identity and payment systems, is creating opportunities for wider access to public and private services while simultaneously raising concerns about privacy, data governance, exclusion, and the protection of democratic participation, according to the 2026 State of Internet Freedom in Africa report.
Titled “State of Internet Freedom in Africa 2026: The Promise of Digital Public Infrastructure and the Reality of Its Impact on Human Rights and Democratic Participation in Africa,” the report was published in September 2026 by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) and launched on October 1, 2026, at the 2026 edition of the Forum on Internet Freedom in Africa (FIFAfrica 2026), which took place in Mauritius.
The study covers Egypt, Ethiopia, Ghana, Kenya, Nigeria, Senegal, South Africa, Tunisia, Uganda, Zambia, and Zimbabwe and examined the relationship between DPI, human rights, and democratic governance in the 11 African countries. It assessed digital identity, payments, and data-exchange systems through a human rights-based framework informed by Human Rights Impact Assessment principles.
The report described Nigeria as one of the countries where DPI is developing at significant scale, particularly in digital identity and payments, but cautions that technical expansion does not necessarily translate into stronger protection of rights, noting that institutional safeguards, access to remedies, and accountability mechanisms can develop at a different pace.
According to the report, Nigeria had 136 million National Identification Number (NIN) enrolments in 2026, the highest figure among the countries examined, with Ethiopia having 50 million enrolments and Ghana having 20 million.
It identified digital identity as one of the foundational components of DPI, alongside digital payments and data exchange, noting that biometric identification systems have become increasingly important across Africa for identity management, elections, border control, and SIM registration.
Nigeria’s scale is also reflected in the report’s comparative data. The country has an estimated population of 220 million, 182.2 million mobile connections, and about 109 million internet users, representing 45.5 per cent internet penetration.
Its UN E-Government Development Index score is 0.5200, while its internet penetration and e-government performance place it above the African regional averages but below global internet-access levels.
The report therefore placed Nigeria among a group of countries, including Kenya, Senegal, and Zambia, that have made progress in connectivity and e-government but continue to face significant demand-side constraints, including device affordability, digital literacy, and gaps in rural infrastructure.
The report highlighted several developments that are increasing the interconnectedness of Nigeria’s digital infrastructure, noting that the Nigeria Inter-Bank Settlement System (NIBSS) launched the National Payment Stack in June 2025, while the National Identity Management Commission Act, 2026 strengthened the harmonisation of identity databases.
It said that, together with the rapid expansion of NIN enrolment, these developments are contributing to an increasingly interconnected ecosystem in which identity and payment infrastructure can support a growing range of public and private transactions.
The report observed that Nigeria’s NIN and payment ecosystem can broaden formal access to services, but the expansion also makes identity-data governance and mechanisms for correcting inaccurate records more consequential because the greater the number of services that depend on foundational identity records, the greater the potential impact of an inaccurate, incomplete, or inaccessible record.
One of the report’s central findings is that interoperability, which is the ability of different digital systems to exchange and use information, can generate significant public value but also amplify systemic risks.
It noted that where records are accurate, access is lawful, and appropriate alternatives exist, data exchange can reduce duplication and improve service delivery, but that where records are inaccurate, mandatory systems are poorly supervised, or correction mechanisms are weak, the same interoperability can spread exclusion or misuse across multiple institutions.
The report specifically identified Nigeria, Ghana, Ethiopia, Uganda, and Kenya as countries where deeper linkage of databases and records has demonstrated both the potential benefits and systemic consequences of interoperability.
For Nigeria, this raises questions about how identity information is accessed and shared across government institutions, financial institutions, telecommunications companies, and other service providers.
The report argued that the critical privacy question is no longer simply where a central database is located but is increasingly about which institution or application can query which record, for what purpose, under whose authority, and how an individual can see and correct the resulting data flow.
It warned that the benefits of DPI are not distributed equally across the countries studied; urban, formally employed, digitally literate, connected, documented, and banked populations tend to benefit first from digital public infrastructure.
By contrast, people with limited connectivity or digital skills and those facing documentation, geographic, or socioeconomic barriers can experience greater difficulties accessing services.
The report noted that digital-first complaint mechanisms exist in several countries, including an online complaints portal operated by Nigeria’s Nigeria Data Protection Commission (NDPC).
However, it cautioned that online complaint systems themselves can become barriers for people who lack reliable internet access, digital literacy, or the ability to navigate formal written procedures.
This creates a particular concern as more essential services become dependent on digital identity and authentication.
The report argued that the important test of a DPI system is whether an affected person can identify the responsible institution, correct an identity record, challenge unauthorised processing, obtain an explanation for a decision and restore access to essential services within a meaningful timeframe.
It stressed that DPI should not be viewed solely as a technical or administrative reform because as digital identity systems become connected with telecommunications, financial services, taxation, social protection, and elections, errors in foundational databases can have consequences beyond the original administrative problem.
The report noted that a person can potentially be excluded from political participation not because an electoral authority has directly barred them, but because birth, citizenship, address, identity, or biometric record held by another institution is missing or inaccurate.
Accordingly, the more services and democratic processes depend on a foundational record, the more important universal documentation, assisted access, and effective mechanisms for correcting records become.
For Nigeria, this is significant given the scale of NIN enrolment and the continuing development of digital systems across government and the financial sector.
The report also examined the relationship between DPI, connectivity, and elections, arguing that the convergence of foundational identity systems, election-management systems, and telecommunications infrastructure creates new democratic risks.
This is because network disruptions, administrative errors or failures in digital systems can affect political participation and the enjoyment of civic freedoms.
The report distinguished election technology from DPI but observed that the two are increasingly converging.
Election technology includes systems used for voter registration, voter identification, results transmission, and public information, while election-related DPI arises when foundational identity, population registers, data-exchange systems, or connectivity layers materially determine electoral inclusion or administration.
The report said the challenge is not digitisation itself, but the combination of complex technology, unequal connectivity, dependence on vendors, and inadequate exception or audit rules.
The report does not portray Nigeria simply as a case of digital-rights failure, but instead emphasised that countries can make progress in one aspect of DPI while retaining weaknesses in another.
It stated that there are no overall “leaders” or “laggards” among the 11 countries studied, as Nigeria, Ethiopia, and Ghana perform strongly in aspects of scale and payments, while Kenya and South Africa are comparatively stronger in institutional contestability.
The report therefore cautioned against treating technical development in one area as evidence of progress across the entire digital-governance ecosystem because technical infrastructure, institutional safeguards, and rights protection can develop simultaneously but at different speeds.
It also described Nigeria and Ghana as countries with growing institutional capacity, while noting that the strongest accountability environments are those where citizens have more than one credible avenue for challenging government or private-sector decisions, including independent regulators, courts, civil society, and sectoral regulators.
CIPESA recommended that governments conduct human-rights, data-protection, and equality impact assessments before major DPI systems are introduced or significantly expanded and called for greater transparency concerning the legal mandates of digital systems, responsible institutions, key suppliers and financiers, system performance and complaint procedures.
Governments are urged to maintain meaningful non-digital alternatives for people who cannot access digital systems and to establish effective mechanisms for correcting records and obtaining remedies.
The report also recommended regular audits of national identity databases, interoperability platforms, and government-to-person payment systems, along with stronger independence, capacity, and transparency for regulatory and oversight institutions.
Technology providers, telecommunications operators, banks, and payment companies were urged to undertake and disclose human-rights due diligence for high-risk DPI projects involving identity, biometrics, data exchange, and surveillance.
The report assigned an important role to civil society organisations, journalists, and researchers in monitoring the development of digital public infrastructure, recommending that civil society and media organisations engage earlier in the process, during policy development, procurement, system design, and impact assessments, rather than waiting until systems have already been deployed.
They were also encouraged to investigate less visible components of DPI, including identity-to-election interfaces, application programming interfaces (APIs), access logs, vendor and hosting arrangements, automated matching systems, and AI-assisted election technologies.
The report concluded that the legitimacy and public trust of DPI systems across Africa will depend on whether rights protections are integrated into their design and operation rather than introduced as retrospective compliance measures.
It called for accessible non-digital channels, strong data-protection principles, data minimisation, independent institutional oversight, open connectivity during elections and political transitions, and timely and enforceable avenues for legal remedy.
For Nigeria, where digital identity enrolment has reached 136 million and national payment and identity systems are becoming increasingly interconnected, the report’s central message is that the success of digital transformation cannot be measured solely by the number of people enrolled, transactions processed, or services moved online.
It argued that inclusion, privacy, accountability, transparency, institutional independence, and the ability of citizens to challenge and correct digital decisions must develop alongside the infrastructure itself.
