Skip to content
Speedmap
Create an account

Compliance

Lawful identity checks, by construction.

The Nigeria Data Protection Act 2023 expects purpose limitation, a lawful basis, data minimisation and accountability. Speedmap builds each into the request path, so every verification carries its purpose, its consent and its audit trail, on every channel.

NDPA CertifiedNigeria Data Protection Act 2023NDPA 2023 and GAID-aligned designNIMC Front-End Processor licenceNIBSS agreement

The framework

What the law asks for, and where Speedmap does it.

NDPA 2023 and GAID

The Act and the General Application and Implementation Directive (effective September 2025) set the rules for processing NIN, BVN, biometric and financial data. Speedmap is designed to them, not retrofitted.

NDPA certified

Speedmap’s operating company is certified under the Nigeria Data Protection Act 2023, and the platform’s controls build on that programme. NDPA Certified

Purpose limitation

Every identity check declares one of the 38 NIMC purpose codes. The code is validated, stored with the result and shown in the audit trail.

Accountability

Consent, purpose, method, channel and every data access are recorded, so you can answer a regulator or an auditor with evidence.

How verification is routed

NIN verification runs through the NIMC-designated verification channel, with NIBSS FAS as an alternative path. BVN, face, bank account, phone and CAC checks run on NIBSS services. Speedmap does not claim direct NIMC database access.

Purpose limitation

38 purpose codes. No free text.

NIMC requires a purpose for every NIN validation, and NIBSS enforces the same list. Speedmap accepts only these values as reason, on the API, in the dashboard and in the MCP tool schemas, so neither an integration nor an AI agent can invent a purpose.

Served live by GET /v1/reasons.

  • 1Taxation EnrollmenttaxationEnrollment
  • 2Taxation AssessmenttaxationAssessment
  • 3Taxation EnforcementtaxationEnforcement
  • 4Corporate Affairs DirectorcorporateAffairsDirector
  • 5Corporate Affairs ShareholdercorporateAffairsShareholder
  • 6Corporate Affairs TrusteecorporateAffairsTrustee
  • 7Medicalmedical
  • 8Education ExameducationExam
  • 9Education AdmissioneducationAdmission
  • 10Education PromotioneducationPromotion
  • 11Employment RecruitmentemploymentRecruitment
  • 12Employment EnrollmentemploymentEnrollment
  • 13Employment DismissalemploymentDismissal
  • 14Credit Background CheckcreditBackgroundCheck
  • 15Financial ProductsfinancialProducts
  • 16Insuranceinsurance
  • 17Clearance For Political OfficeclearanceForPoliticalOffice
  • 18Legal CourtslegalCourts
  • 19Legal EnrollmentlegalEnrollment
  • 20Crime Prison IncarcerationcrimePrisonIncarceration
  • 21Passport ImmigrationpassportImmigration
  • 22Pension EnrollmentpensionEnrollment
  • 23Socio-cultural EnrollmentsocioCulturalEnrollment
  • 24Entertainmententertainment
  • 25Physical AccessphysicalAccess
  • 26Logical Virtual AccesslogicalVirtualAccess
  • 27Telecommunication Sim RegistrationtelecommunicationSimReg
  • 28Telecommunication Iot RegistrationtelecommunicationIotReg
  • 29Aviation TransportaviationTransport
  • 30Road TransportroadTransport
  • 31Maritime TransportmaritimeTransport
  • 32Railway TransportrailwayTransport
  • 33Lea CheckleaCheck
  • 34Defencedefence
  • 35NYSC ChecknyscCheck
  • 36EFCC CheckefccCheck
  • 37Blacklist PoliticalblacklistPolitical
  • 38Blacklist SocialblacklistSocial

Data minimisation

The same check returns less, wherever less will do.

Speedmap receives the full record and decides what leaves the platform. Most channels never need the record, so they never receive it.

  • REST API, full tier

    Returns
    Normalized record, after approval for the use case

  • REST API, assertion tier

    Returns
    Status, match, field matches, masked name, reference

  • Webhooks

    Returns
    Assertion only; fetch detail by reference

  • MCP (Speedmap Connect)

    Returns
    Assertions only, never personal data

  • Bulk

    Returns
    Job handle; PII-free rows in the dashboard

  • Dashboard

    Returns
    Assertion by default; full record on audited reveal by permitted roles

Accountability

Evidence, retention and your obligations.

Audit trail

Every check records its purpose code, consent mechanism, method, channel and timestamps. Full-record reveals, consent changes and key and member changes are written to the audit log.

Retention and deletion

Records are kept only as long as needed for the purpose, your contract and legal obligations, and deleted or anonymised on request where legally permissible.

Encrypted and masked

Records are sealed with AES-256-GCM at rest; identifiers are stored as keyed hashes and masked in lists, logs and webhooks. See Security for detail.

Going live is a compliance step, not just a switch

Before live access, Speedmap reviews your organisation and use case and enables only the products and response tier it justifies. As part of go-live we ask customers to confirm the controls the NDPA expects of them:

  • NDPC registration, where your processing requires it
  • A designated Data Protection Officer
  • A documented lawful basis and privacy notice
  • Breach procedures for the 72-hour notification window

What cannot be built

No reverse lookup. Not now, not for anyone.

Stated plainly so it never becomes a feature request.

Nothing turns a phone number or name into a NIN

Every NIN verification method requires the identifier up front: the NIN itself, the NIN with a selfie, or a share code the subject generates. Nothing in Speedmap accepts a phone number, name or date of birth and returns a NIN or BVN. Phone lookup returns names and date of birth for corroboration, never the NIN or BVN. NIMC and NIBSS deliberately withhold reverse lookup, because it is the most abusable endpoint in an identity system. A person who has forgotten their NIN can retrieve it from NIMC directly, using the SIM registered to it.

No claims we cannot support

We do not claim direct NIMC database access, certifications we do not hold, or live availability for products whose provider agreements are pending. Passport, driver’s licence and voter’s card checks are previews and not yet live until those agreements are signed.

FAQ

Compliance questions.

Data protection enquiries: privacy@speedmap.ng.

Is Speedmap NDPA compliant?
Speedmap is designed around the Nigeria Data Protection Act 2023 and the GAID: purpose limitation through the NIMC purpose codes, consent before execution, category-scoped consent, assertion-only responses wherever a record is not needed, encryption at rest and an audit trail. Speedmap’s operating company is NDPA certified. Compliance is shared: you remain responsible for your own lawful basis, notices and records.
Does Speedmap verify directly against the NIMC database?
No. NIN checks are verified against the NIMC record through the NIMC-designated verification channel, with NIBSS FAS as an alternative path. BVN, face, account, phone and business checks run on NIBSS services. Speedmap does not claim direct access to the NIMC database.
Who is the controller and who is the processor?
For verifications you request, you decide the purpose and means, and Speedmap processes the data on your behalf under our terms and data processing addendum. We are a controller for our own account, billing and security data.
Can someone find a NIN from a phone number or name?
No. Nothing in Speedmap turns a phone number, name or date of birth into a NIN or BVN. NIMC and NIBSS deliberately withhold reverse lookup, and so do we.
Can a data subject ask for their data to be deleted?
Yes. Requests can be sent to privacy@speedmap.ng. Where Speedmap processes data for a customer we route the request to that customer as controller. We delete or anonymise data where it is legally permissible to do so; some records must be kept to meet regulatory, audit or dispute obligations.
Security controls Privacy policy Consent-as-a-Service

Make every check defensible.

Purpose, consent and an audit trail on every verification, from the first test call. Talk to us about your compliance requirements before you go live.

Create an account Read the quickstart