NIRA Delegation Visits Pakistan to Learn from All-Encompassing Identity Model

ISLAMABAD — A Somali delegation led by the Director General of the National Identification and Registration Authority (NIRA) has concluded a series of institutional engagements in Islamabad as part of its Peer Learning Mission on Foundational ID and Digital Public Infrastructure.

The delegation visited the Federal Board of Revenue (FBR) for an interactive session focused on understanding the linkages between identity, taxpayer registration, and public administration. It also visited the Benazir Income Support Programme (BISP) to examine the use of identity in social registries, beneficiary verification, and cash-transfer programmes, including their linkages with humanitarian registration and assistance systems.

According to NIRA, these engagements deepened its understanding of the role of the National ID and how its integration with social protection benefits can improve access to services and support more inclusive service delivery in Somalia.

Pakistan’s All-Encompassing Identity Model

Pakistan’s identity system, managed by the National Database and Registration Authority (NADRA), is among the most comprehensive in the world. The recent amendments to the National Identity Card Rules introduced QR-based verification, reinforced biometric recognition through fingerprints and iris scans, and enabled interoperability through the National Data Exchange Layer. These reforms strengthen the legal and technological foundations of Pakistan’s identity ecosystem, enabling instant verification and reducing fraud risk.

The Benazir Income Support Programme, one of the world’s largest cash transfer programmes, relies heavily on this identity infrastructure for beneficiary verification and social registry management. The programme links identity to social protection, allowing the government to verify eligibility and distribute payments to millions of beneficiaries.

Privacy and Data Protection Concerns

However, Pakistan’s identity system has also faced significant criticism over data protection and privacy. In 2024, NADRA fired multiple officials after an investigation into the compromised data of 2.7 million people between 2019 and 2023. The breach involved biometric data and SIM verification data, with traces found in Romania and Argentina. Civil society organizations have noted that SIM and CNIC data has been readily available on random websites, enabling anyone to search phone numbers, home addresses, and national ID numbers of any person.

A draft Personal Data Protection Bill has been in the works since at least 2018, but it has not been enacted, leaving the data of over 220 million Pakistanis at constant risk of unauthorized access and breach. Critics have argued that the draft bill has been driven more by political motivations than by a rights-based approach to privacy protection.

The BISP has also faced audit findings revealing that government employees, pensioners, and even their spouses continued receiving financial assistance despite being ineligible under programme rules. The audit pointed to weak data verification and oversight mechanisms that allowed irregular payments to continue. This highlights a critical challenge in welfare policy: it is not about how much money is allocated but how effectively it is targeted and monitored.

Somalia’s ID Rollout and Data Protection Gaps

Somalia launched its National ID system in September 2023 with technical support from NADRA. The system is part of a multimillion-dollar grant extended by Pakistan to Somalia and has since registered over 1.2 million Somalis, with 47 percent female enrolment achieved through gender-responsive protocols.

Somalia enacted its Data Protection Act in 2023, establishing a legal framework for data protection and creating the Somali Data Protection Authority However, according to a 2026 study published in Discover Global Society, the available public evidence does not yet show that legal authority has been fully translated into operational control. The study argues that Somalia’s data sovereignty challenge is best understood as governance under structural dependence, where the difficulty lies in the interaction among the absence of operational law, external hosting, and weak institutions.

The Data Protection Authority has not been fully operationalized, and most organizations operating in Somalia are unaware of their compliance obligations under the 2023 Act. Cross-border transfers of personal data require safeguards, yet enforcement mechanisms remain weak.

Somalia’s ID system also remains donor-dependent and uneven in its reach. While enrolment numbers have risen dramatically, key regions like Puntland still lack a fully functioning ID office, highlighting gaps in equitable access. The system has been praised for achieving $4.2 million in estimated savings in 2025 by integrating the national ID with passports, banks, and the education sector, yet it remains more project-like than institutional.

Political Fragmentation and Regional Resistance

The political fragmentation of Somalia’s federal system has complicated the ID rollout. Puntland has firmly rejected the federal government’s proposal to centralize IDP registration and link humanitarian aid to a national system, warning that the move undermines Somalia’s federal structure and threatens to politicize relief operations. President Said Abdullahi Deni signed a decree creating the Puntland Identification Authority (PID) to issue ID cards independent of NIRA.

Puntland’s information minister has stated that “anyone who takes the NIRA card will be seen as hostile, and we will detain them”, reflecting the deep distrust between Mogadishu and Garowe over the ID system.

NIRA has expanded services to the diaspora, opening a service center at the Somali Embassy in Nairobi, as part of a wider federal strategy to enhance Somalia’s national identity framework and facilitate better access to public services for citizens abroad.

The government has also mandated that starting July 1, 2026, all citizens will be required to present a National Identification Card or an official certificate confirming registration with NIRA to obtain a Somali passport.

Critical Note

Somalia’s decision to study Pakistan’s identity model is understandable given NADRA’s technical expertise and the existing partnership between the two countries. However, Pakistan’s experience also offers cautionary lessons. The country’s identity system is all-encompassing, linking biometric data to tax administration, social welfare, and a wide range of public services. Yet this integration has come at a cost: repeated data breaches, unauthorized access to citizen data, and audit findings of ineligible beneficiaries receiving welfare payments.

The risk for Somalia is that it may adopt the technical architecture of Pakistan’s system without the legal and institutional safeguards needed to protect citizens’ data. Somalia’s Data Protection Act exists on paper, but the authority tasked with enforcing it has not been fully operationalized. As the ID system expands to link with social protection, tax administration, and humanitarian assistance, the amount of sensitive personal data being collected and shared will grow exponentially. Without robust enforcement mechanisms, this data could be vulnerable to misuse, unauthorized access, or political manipulation.

Privacy advocates have warned that digital ID requirements can create “algorithmic poverty,” where exclusion becomes a technical glitch rather than a policy choice. When systems fail through fingerprint mismatches, database gaps, or rigid verification rules, the cost is borne by the poorest. For Somalia, where a significant portion of the population is displaced, rural, or lacks documentation, the risk of exclusion from essential services is particularly acute.

The Somali government and its international partners should prioritize the operationalization of the Data Protection Authority before expanding the ID system’s integration with sensitive sectors. Building public trust in the identity system requires demonstrating that citizens’ data will be protected and used responsibly. Without this foundation, the national ID risks becoming a tool of surveillance and exclusion rather than a mechanism for inclusion and service delivery.