When a video alleging that Nigerians’ National Identification Numbers had been exposed and offered for sale began circulating recently, the National Identity Management Commission (NIMC) moved quickly to deny it. Its statement, delivered through Head of Corporate Communications Kayode Adegoke, was clear: NIMC’s systems remain protected, the claims are misleading, and Nigerians should disregard unverified information. Director-General Abisoye Coker-Odusote simultaneously ordered a comprehensive investigation, but not into whether NIMC’s core database had been compromised, but into whether its licensed tokenisation verification agents, or their sub-licensees, had breached their licensing agreements.
That distinction is easy to miss on a first read. It shouldn’t be. It is, in fact, the single most instructive detail in the entire episode for anyone working in marketing communication today.
A narrower denial than it sounds
NIMC did not say “no data was exposed anywhere in our ecosystem.” It said its own systems were protected, while ordering an investigation into the agents and sub-licensees operating at the edge of that ecosystem. This is also precisely the layer where a similar controversy played out in 2024, when a private platform was found retrieving Nigerians’ personal information through licensed access channels. That earlier episode led NIMC to restrict agent access and introduce mandatory security vetting for its Front-End Partners. The current allegation suggests the underlying structural risk, a large, tightly governed core surrounded by a looser, harder-to-monitor network of licensed and sub-licensed agents, has not really gone away.
For marketing communication professionals, this is not simply a story about a government agency managing a reputational scare. It is a mirror.
We live in the same structure NIMC does
Most agencies, PR firms, and communication consultancies operate under exactly the same controller-processor duality that is now under scrutiny at NIMC. When you run a client’s CRM campaign, manage their stakeholder database, or execute an influencer activation using data the client supplied, you are typically a data processor acting on their instructions. When you build and maintain your own agency’s contact lists, prospect databases, or event registration systems, you are the controller, carrying full accountability for how that data was sourced, secured, and used.
The trouble is that many practitioners don’t consciously track which hat they are wearing at any given moment, and under the Nigeria Data Protection Act 2023 (NDPA) and the NDPC’s General Application and Implementation Directive 2025 (GAID), that distinction determines who is legally answerable when something goes wrong.
It also determines something just as important in a crisis: who is entitled to speak, and with what authority.
The crisis communication lesson hiding inside the compliance lesson
If you are a processor, managing communications or data on a client’s behalf, you do not get to make the controller’s determinations. A statement like “our systems are protected” or “no breach occurred” is a technical and legal conclusion that belongs to the controller, informed by forensic investigation and legal counsel. A communication consultant who gets ahead of that determination, however well-intentioned, is making a claim they are not positioned to verify, and the client may not be positioned to stand behind once the facts are fully known.
However, if you are the controller, accountable for your own agency’s database, you do not get to hide behind a client relationship when something in your own systems is implicated. The obligation to notify, investigate, and remediate sits with you directly.
NIMC’s statement is, whether by design or not, a useful study in getting this distinction right under pressure. It made a claim precisely scoped to what NIMC could actually stand behind, the security of its own systems, while visibly commissioning an investigation into the parts of the ecosystem it did not yet have full assurance about. It offered the public practical protective guidance (use only approved verification channels) that did not require the underlying facts to be settled first. And it anchored its credibility partly in a track record, the 2024 agent vetting measures, that only works as reassurance if that track record can actually withstand scrutiny when examined.
Why this should change how we brief campaigns
The deeper lesson for our industry is that data governance and crisis communication are no longer separable disciplines. A campaign brief that doesn’t ask who collected this data, under what basis, and whether any sub-vendor or platform touches it downstream, is not simply a compliance gap. It is a crisis waiting to happen, and when that crisis happens, unfortunately, it is the practitioner who drafted the original campaign who will often be the same person asked to draft the response.
That is an uncomfortable position to be in without having done the groundwork first: knowing, before anything goes wrong, whether you are the controller or the processor for every dataset your agency touches; knowing whether your data processing agreements with clients and sub-vendors actually specify security obligations and breach notification timelines, rather than simply licensing terms; and knowing, in advance, exactly what you are and are not authorised to say publicly if an allegation surfaces tomorrow.
The real takeaway
The gap between a narrow, accurate claim and the broader impression the public takes from it is where reputations are made or lost in moments like this. NIMC’s “our systems are protected” will, in hindsight, read as either a careful statement or a false impression, and whichever one it turns out to be will depend entirely on what the investigation finds, and on whether that false claim was deliberate.
Marketing communication professionals should take the same discipline into every client relationship, long before a crisis makes it unavoidable: state only what has been verified, distinguish your organisation’s own systems from the wider ecosystem of vendors and partners you rely on, and know precisely which hat, controller or processor, you are wearing before you ever have to speak on anyone’s behalf under pressure.
Dr. Ginger-Eke is Founder and Chief Strategist of The Rainbow Strategy, a public affairs, strategic communication and data protection compliance consulting firm licensed by the Nigeria Data Protection Commission as a Data Protection Compliance Organisation.
Email: info@therainbowstrategy.ng
