Kampala, Uganda: Legal experts and government regulators have raised serious concerns about potential data protection gaps in the ongoing mass National ID registration and renewal exercise, warning that millions of citizens’ sensitive personal information could be exposed without stronger safeguards.
Speaking at a high-level engagement hosted by the Radical New Bar (RNB) at the Uganda Law Society (ULS) House in Kampala, data protection lawyer Apollo Muhindo criticised the National Identification and Registration Authority (NIRA) for failing to publish a legally mandated Data Protection Impact Assessment (DPIA).
“We are dealing with highly sensitive personal data, names, dates of birth, biometrics, and unique identifiers,” Muhindo said. “This is not just an administrative exercise; it has profound implications for the rights, dignity, and safety of Ugandans.”
Muhindo argued that transparency and accountability are “not optional,” adding that no DPIA has ever been shared with the public despite NIRA’s massive centralised database holding the records of over 27 million people.
Responding to Muhindo’s concerns, Baker Birikujja, Acting Director of Uganda’s Personal Data Protection Office (PDPO), which regulates data collected by NIRA, confirmed that while a preliminary DPIA was conducted in March 2024, only summaries, not full reports, would be published to avoid exposing system vulnerabilities.
“Even before the renewal exercise began, NIRA invited us to train their staff, and over 400 permanent employees signed data privacy commitment forms,” Birikujja noted. “We have also developed an audit and inspection manual, and NIRA will be among the first entities audited in the next financial year.”
He added that any misuse of personal data could result in penalties of up to 2% of an institution’s budget and possible imprisonment of individuals involved.
On her part, NIRA Executive Director Rosemary Kisembo firmly defended the authority’s mandate, stating that its data collection, down to tribal, parental, and biometric details, is grounded in the Constitution and the Registration of Persons Act.
“Article 10 defines who a Ugandan is, and tribe, heritage, and ancestry are critical components of that definition,” Kisembo argued. “We are not collecting this data illegally—we are doing so under the law.”
Ms Kisembo also dismissed claims that NIRA was violating privacy or excluding people, stating that the authority only shares data with third parties upon consent, and that even relatives are denied access without proper authorization.
“You, citizens, are often the biggest risk to your personal data. How many of you have left a photocopy of your ID somewhere?” she asked, sending the audience into silence. “Meanwhile, on our side, we require your fingerprint before we share any data.”
On accessibility bottlenecks, Kisembo said NIRA was currently deployed at the parish level in all 71,000 villages nationwide for the mass registration exercise. “This notion that NIRA’s process excludes people is a fallacy. Who among us doesn’t have a face or an iris? We take what we can get, biometrics aren’t one-size-fits-all,” she firmly said in defense.
Kisembo acknowledged that challenges remain, including duplicate or shared names and dates of birth in the National ID Register, which justifies the importance of biometric capture. “We have 450,000 people in our database with the same three names and birth date. That’s why biometrics are critical.”
The ED also called for more civic education, especially around how citizens should protect their own data. “Personal data will not be protected by NIRA alone. Citizens must be empowered to do their part.”
The engagement was part of an ongoing national dialogue on how to improve privacy compliance in Uganda’s digital transformation journey, especially with NIRA’s mass ID renewal deadline looming ahead of the 2026 general elections.
If you would like your article/opinion to be published on Uganda’s most authoritative news platform, send your submission on: [email protected]. You can also follow DailyExpress on WhatsApp and on Twitter (X) for realtime updates.
