Compliance and data protection
How Speedmap handles purpose limitation, consent, data minimisation and audit under the Nigeria Data Protection Act 2023.
Speedmap processes NIN, BVN, biometric and financial data on behalf of its business clients. The platform is designed so the compliant path is the default one: purpose and consent are enforced before a provider is called, and responses carry the minimum data needed.
Where the data comes from
- NIN checks are verified against the NIMC record through Speedily’s licensed Front-End Processor access.
- BVN, face (N-Face), phone, bank account (ICAD), fraud signals and CAC business checks go through NIBSS.
- Speedily Services Limited holds a NIMC Front-End Processor licence, NDPA certification and a NIBSS agreement.
Raw NIN lookup (sending a bare NIN) is restricted by NIMC to financial institutions and government agencies. Other businesses verify with the subject present: an in-person selfie or a NINAuth share code.
NDPA 2023
Under the Nigeria Data Protection Act 2023 you are the data controller for the checks you run, and Speedmap processes data on your behalf. The API gives you the building blocks for your obligations:
| Principle | How Speedmap supports it |
|---|---|
| Lawful basis and consent | Every check records a consent mechanism and timestamp. Full BVN records require consent granted by the data subject. |
| Purpose limitation | Every identity check declares one of the 38 NIMC purpose codes, stored with the verification. |
| Data minimisation | Assertions by default; the full record only for full-tier REST clients. MCP, webhooks, lists and bulk never carry it. See Response shaping. |
| Security | TLS in transit, records encrypted at rest, identifiers masked in logs and dashboards, provider calls server-side only. |
| Accountability | An immutable audit log of every data-access event, including each reveal of a full record in the dashboard. |
Consent mechanisms
Each verification reports how consent was satisfied in consent.mechanism:
| Mechanism | Used by | Meaning |
|---|---|---|
client_attested | NIN (nin), BVN (boolean), phone, fraud signals, documents | You attest, with consent: { "obtained": true }, that you obtained consent for the declared purpose. Keep your own evidence. |
in_person_selfie | NIN (in_person), face | The live selfie, captured with the subject present, is the consent. |
ninauth_share_code | NIN (share_code) | The subject generated the code in the NINAuth app. |
nibss_consent_hub | BVN (core) | The subject approved a consent request by link, email or USSD. |
public_registry | Business | CAC records are public. |
not_required | Bank account | Name enquiry needs no consent. |
Purpose codes
Identity checks take a reason: one of the 38 purpose codes NIMC permits. The same list governs the NIBSS request reason. A request with any other value is rejected before it reaches a provider, because a misdeclared purpose is a licence-level violation. Declare the purpose that truly applies; if you are unsure, ask your DPO before sending the check.
GET /v1/reasons returns this list.
| Key | Label |
|---|---|
taxationEnrollment | Taxation Enrollment |
taxationAssessment | Taxation Assessment |
taxationEnforcement | Taxation Enforcement |
corporateAffairsDirector | Corporate Affairs Director |
corporateAffairsShareholder | Corporate Affairs Shareholder |
corporateAffairsTrustee | Corporate Affairs Trustee |
medical | Medical |
educationExam | Education Exam |
educationAdmission | Education Admission |
educationPromotion | Education Promotion |
employmentRecruitment | Employment Recruitment |
employmentEnrollment | Employment Enrollment |
employmentDismissal | Employment Dismissal |
creditBackgroundCheck | Credit Background Check |
financialProducts | Financial Products |
insurance | Insurance |
clearanceForPoliticalOffice | Clearance For Political Office |
legalCourts | Legal Courts |
legalEnrollment | Legal Enrollment |
crimePrisonIncarceration | Crime Prison Incarceration |
passportImmigration | Passport Immigration |
pensionEnrollment | Pension Enrollment |
socioCulturalEnrollment | Socio-cultural Enrollment |
entertainment | Entertainment |
physicalAccess | Physical Access |
logicalVirtualAccess | Logical Virtual Access |
telecommunicationSimReg | Telecommunication Sim Registration |
telecommunicationIotReg | Telecommunication Iot Registration |
aviationTransport | Aviation Transport |
roadTransport | Road Transport |
maritimeTransport | Maritime Transport |
railwayTransport | Railway Transport |
leaCheck | Lea Check |
defence | Defence |
nyscCheck | NYSC Check |
efccCheck | EFCC Check |
blacklistPolitical | Blacklist Political |
blacklistSocial | Blacklist Social |
Audit and retention
Every verification, consent decision, key change, webhook change and record reveal is written to an append-only audit log, visible to your team in the dashboard. Your verification history is retained under a defined retention policy, with deletion on request where the law allows it.
Your obligations
- Collect and keep evidence of consent when you attest it.
- Declare the true purpose of each check.
- Restrict who in your organization can see full records. Dashboard roles help: only owners and admins can reveal records.
- Report incidents. Under the NDPA, personal data breaches must be notified to the NDPC within 72 hours.
Contact
Questions about data protection, data subject requests or our data processing terms go to our Data Protection Officer at privacy@speedmap.ng. Report security issues to security@speedmap.ng.
Questions? Email developers@speedmap.ng. This page is also available as Markdown.