Uganda’s 2026 Polls Expose Dangerous Gaps in Data Protection Enforcement – New Report Warns

KAMPALA – As Uganda reflects on the just-concluded 2026 General Elections, a new report by digital rights organization Unwanted Witness has raised serious concerns over how personal data was collected, processed, and protected during the country’s most technology-driven election cycle.

The report, titled “Uneven Enforcement of Data Protection Laws Puts Data Subjects’ Rights at Risk in Uganda’s 2026 Polls,” argues that while Uganda has the legal framework to protect citizens’ personal data, enforcement remains selective, weak, and inconsistent—leaving millions of voters exposed to privacy violations, political profiling, and possible manipulation.

According to the findings, Uganda entered the January 2026 elections with the Data Protection and Privacy Act of 2019 and the 2021 Regulations in place, alongside electoral laws and international privacy standards. However, the report says compliance was “operationally under-embedded,” meaning many institutions had the law on paper but failed to apply it in practice.

This is a major warning for Ugandan voters.

From biometric voter registration to SIM card verification, mobile money transactions, campaign databases, surveillance systems, and social media targeting, elections today depend heavily on personal data. The report warns that poor enforcement creates opportunities for abuse, including unauthorized access to voter information, misuse of biometric data, unlawful surveillance, and manipulation of political choices.

For ordinary Ugandans, this means a voter’s phone number, National ID details, location, political preference, and even facial or fingerprint data can be collected and used without proper consent or transparency.

The report highlights selective enforcement as one of the biggest threats. It notes that some institutions and actors are subjected to regulatory scrutiny while others—particularly politically connected actors—appear to operate with little accountability. This creates what the researchers describe as a dangerous imbalance where the law protects some people but not others.

For policymakers, this is a direct challenge.

Uganda’s regulators, especially the Personal Data Protection Office under National Information Technology Authority-Uganda, are being urged to move beyond symbolic compliance and enforce the law uniformly. The report calls for stronger oversight of political parties, telecom companies, campaign consultants, and state institutions handling citizens’ data during elections.

Without credible enforcement, the law risks becoming a public relations document rather than a shield for citizens.

This concern is not new. In its earlier Privacy Scorecard, Unwanted Witness found that many of Uganda’s top data collectors—including telecoms, banks, e-commerce platforms, and even government institutions—performed poorly on basic privacy obligations such as informing users how their data is used and disclosing third-party sharing. Only 8 percent clearly indicated third parties with whom personal data would be shared, while none disclosed how much data was shared with government or law enforcement agencies.

That pattern appears to have persisted into the 2026 elections.

The report comes shortly after another major finding by the same organization documenting Uganda’s four-day nationwide internet shutdown before and during polling. That shutdown, which began on January 13, 2026, disrupted public access to information and limited digital accountability during one of the most sensitive democratic moments in the country.

For the international community, the report presents Uganda as a test case in Africa’s growing struggle between digital innovation and democratic accountability.

Many African countries are rapidly digitizing elections, public services, and identity systems. But without strong safeguards, digital governance can easily become digital control. Uganda’s experience shows that passing laws is not enough; institutions must be independent enough to enforce them fairly.

Development partners, election observers, and democracy-support organizations are therefore being challenged to look beyond ballot boxes and include digital rights in election assessments. Privacy, surveillance, and internet freedom are now central election issues—not side conversations.

The broader message is simple but powerful: democracy cannot survive where citizens fear how their personal information will be used.

If voters suspect that registering to vote also means exposing themselves to surveillance, intimidation, or political targeting, trust in the electoral process weakens.

For Uganda, where political trust is already fragile, that is a serious national risk.

As the country moves toward post-election reforms, the report urges Parliament, regulators, political actors, and civil society to treat data protection as a democratic issue—not merely a technical ICT matter.

Because in modern elections, protecting privacy is also protecting the vote.

And protecting the vote is protecting democracy itself.

The post Uganda’s 2026 Polls Expose Dangerous Gaps in Data Protection Enforcement – New Report Warns appeared first on Watchdog Uganda.