By A.K. Sempala 
Data Protection and Digital Governance Expert | Advocate | Head of Legal & Programs, Unwanted Witness 

Kampala, Uganda | 10 August 2026 

Every society eventually confronts the same question: who should control identity? 

In the digital age, that question is no longer philosophical. It is administrative, technological and profoundly political. Increasingly, identity determines not only who we are, but whether we can vote, access public services, open a bank account, register a SIM card or participate fully in modern society. 

Uganda’s 2026 general elections illustrate how quickly that transformation is unfolding. The debate is often framed around privacy, cybersecurity or election technology. Yet these are only parts of a much larger story. The real issue is power; who holds it, how it is exercised, and what safeguards exist when one’s digital identity becomes the gateway to citizenship itself. 

Uganda’s latest elections marked a significant milestone in the country’s digital transformation. More than 109,000 biometric voter verification kits were deployed nationwide, while the National Identification Number (NIN) became increasingly embedded in voter registration and identity verification. Together, these developments created a tightly integrated digital identity ecosystem linking civil registration and electoral administration.  

There are compelling reasons why governments pursue such integration. Biometric verification can reduce duplicate registrations, strengthen electoral integrity, improve administrative efficiency and make public services more reliable. As digital economies expand, governments understandably seek interoperable systems capable of serving multiple public functions. 

Technology, however, is rarely neutral. 

The more powerful a digital identity system becomes, the more important its governance becomes. 

Unwanted Witness’s recent report on data protection during Uganda’s 2026 elections argues that the country’s legal framework was not absent; rather, its implementation failed to keep pace with technological integration. Compliance remained uneven, institutional oversight fragmented, and critical governance safeguards were inconsistently applied across institutions.  

This distinction matters. 

The challenge is not that Uganda adopted biometric technologies. The challenge is that the architecture connecting identity, elections and public administration evolved faster than the institutional mechanisms designed to govern it. 

That is where the real risks emerge. 

The first is function creep. 

History shows that data collected for one legitimate purpose rarely stays confined there. Information initially gathered for civil registration can gradually become indispensable for banking, taxation, telecommunications, health services, elections and future technologies not yet imagined. The report identifies precisely this risk: integrating the NIN and voter systems may repurpose civil identity information beyond its original purpose unless clear legal boundaries are maintained.  

The second concern is centralisation. 

Unlike passwords, biometric identifiers cannot simply be changed after a breach. Fingerprints and facial characteristics remain with us for life. When one identity infrastructure underpins multiple public functions, a single vulnerability can create consequences far beyond elections. As the report observes, biometric data and NIN-linked identifiers are effectively irreversible credentials whose compromise carries long-term implications.  

The third and perhaps most important is opaque interoperability. 

Citizens rarely know how information moves between public institutions. Which agencies exchange data? Under what legal authority? Who authorizes access? Who audits these transfers? How long is information retained? Who is accountable when something goes wrong? 

The report found no publicly accessible inter-agency framework governing the increasingly integrated relationship between the Electoral Commission and the National Identification and Registration Authority. Without transparent rules defining purpose limitation, retention schedules, audit rights and independent oversight, technological integration risks outpacing democratic accountability.  

None of these questions are unique to Uganda. 

India continues to debate the governance of Aadhaar. Kenya has wrestled with challenges surrounding Huduma Namba. The European Union is constructing its Digital Identity Wallet while embedding extensive regulatory safeguards. Estonia demonstrates that highly digital states can also prioritize transparency, auditability and citizen trust. 

Across the world, the debate is no longer whether governments should build digital identity systems. They already have. 

The debate is how democratic societies should govern them. 

Uganda therefore has an opportunity not merely to modernize elections, but to demonstrate how digital identity can strengthen democracy without weakening constitutional accountability. 

That begins with governance rather than technology. 

Independent Data Protection Impact Assessments should become standard practice for high-risk biometric systems. Inter-agency data-sharing arrangements should be publicly documented. Purpose limitation should be enforceable rather than aspirational. Independent cybersecurity audits, transparent retention schedules and parliamentary oversight should accompany every significant expansion of digital identity infrastructure. These recommendations reflect many of the reforms proposed in the Unwanted Witness report.  

The report concludes that Uganda’s 2026 elections did not expose a legislative vacuum; they exposed an implementation deficit. That observation deserves careful attention because implementation not legislation is increasingly the defining challenge of digital governance.  

Digital identity is rapidly becoming the passport to modern citizenship. 

The question is no longer whether governments should verify identity digitally. Nor is it whether biometric technologies will continue expanding. Both trends are already well underway. 

The more enduring question is whether democratic institutions will evolve quickly enough to ensure that systems designed to verify citizens do not quietly redefine the balance of power between citizens and the state. 

In the end, the future of digital identity will not be decided by algorithms or biometric scanners. 

It will be decided by governance.