How personal data was politicized in Uganda’s 2026 elections and what it teaches us about democracy

By Unwanted Witness

27 January 2026-Kampala, Uganda | Africa. Elections are often discussed in terms of votes cast, ballots counted, and results announced. But in Uganda’s 2026 General Elections, a quieter and more consequential struggle unfolded beneath the surface over who controls citizens’ personal data, how it is used, and to what ends.

Unwanted Witness’s ongoing investigations into the 2026 electoral cycle demonstrate that data privacy is not a peripheral concern but a core pillar of electoral integrity, democratic trust, and voter autonomy. The forthcoming report will show how the mishandling, politicization, or weaponization of personal data directly undermines the credibility of elections and erodes public confidence in democratic processes.

Elections in the Age of Data

Uganda’s elections have become increasingly digital over the past decade. Biometric voter registration and verification systems, national identity databases, electronic voter registers, bulk SMS campaigning, and social media platforms now sit at the heart of how elections are administered and contested.

By 2026, the Electoral Commission had deployed over 109,000 biometric voter verification kits nationwide, while political actors relied heavily on bulk messaging, digital profiling, and online persuasion to reach voters.

This transformation expanded efficiency and reach. But it also dramatically increased the volume of sensitive personal data being collected, stored, shared, and reused often without transparency, meaningful consent, or effective oversight.

1. Voter Data as a Political Resource

During the campaign period, voters across the country reported receiving unsolicited political SMS messages, calls, and WhatsApp messages urging them to attend rallies, support candidates, or contribute funds. Many recipients had no prior relationship with the sender and had never consented to political messaging.

This raised a fundamental question: where did these phone numbers come from?

Evidence documented by Unwanted Witness, and set out in detail in a forthcoming report to be released shortly, indicates that voter contact data may have been obtained and utilised through multiple pathways. These include the possible repurposing of data originally collected during voter registration or SIM registration processes, acquisition through opaque third-party data brokerage arrangements, and aggregation via informal digital marketing networks operating with limited transparency or oversight.

In the absence of disclosure, privacy notices, or consent mechanisms, personal data originally collected for civic or administrative purposes appeared to be recycled into campaign infrastructure, violating principles of lawful processing and purpose limitation under Uganda’s Data Protection and Privacy Act, 2019.

2. WhatsApp Groups and the Illusion of Choice

WhatsApp became one of the most influential political spaces of the 2026 elections. Thousands of voters found themselves added to political groups without consent, exposing their phone numbers and identities to strangers and partisan debate.

While it is often argued that users can simply “exit the group,” this misses the core privacy issue. The harm occurs before exit is possible:

• Phone numbers are disclosed without permission
• Political affiliation can be inferred
• Data is shared with unknown third parties

The right to exit does not substitute for the right to prior consent. In electoral contexts, such practices create risks of intimidation, profiling, and chilling effects on political participation.

3. Biometric Systems Without Transparency

Biometric voter verification was presented as a safeguard against fraud. Yet Unwanted Witness’s post-election analysis found persistent gaps in transparency around:

• What biometric data was stored on devices
• How long data was retained
• Who had access to logs and backend systems
• Whether independent audits or DPIAs were conducted

The Electoral Commission, despite being one of the country’s largest holders of sensitive personal and biometric data, was not registered with the Personal Data Protection Office (PDPO) and had no publicly accessible privacy policy, even after formal advisories to comply.

This institutional non-compliance weakened public trust and undermined the legitimacy of enforcement actions taken under the same law.

When Data Protection Becomes a Tool of Power

Perhaps the most troubling lesson from 2026 is not simply that data was misused but how data protection law itself was applied.

Unwanted Witness documented a pattern of selective enforcement, where:

• Major data-holding institutions operated outside core compliance requirements
• Political parties failed to register or publish privacy notices
• Yet individuals and civil society actors faced criminal liability under the Data Protection Act

The prosecution of human rights defenders under Section 35 of the Act, while systemic institutional non-compliance persisted, exposed a dangerous inversion: a rights-protective law risked being transformed into a punitive instrument.

Data protection, instead of constraining power, began to mirror existing political asymmetries.

What Uganda’s Elections Teach Us About Privacy and Democracy

Uganda’s 2026 elections offer several hard-won lessons:

1. Privacy Is a Precondition for Trust

When voters fear that their biometric data, phone numbers, or political preferences may be misused, participation suffers. Electoral credibility depends on confidence that data will not be turned against citizens.

2. Technology without Governance Deepens Risk

Digitization alone does not strengthen elections. Without transparency, audits, and accountability, technology amplifies existing power imbalances.

3. Consent Cannot Be Assumed

In electoral contexts, participation is often compulsory or unavoidable. This makes meaningful consent even more important, not less.

4. Enforcement Must Be Equal

Data protection law cannot build trust if it is applied selectively. Electoral authorities, political parties, and private vendors must be held to the same standards as citizens and civil society.

Why Data Privacy Is the Missing Piece

Elections are no longer just about ballots, they are about data architectures. Who designs them, who controls them, and who is protected by them determines whether elections empower citizens or expose them.

Uganda’s 2026 experience shows that electoral integrity cannot be separated from data protection. Privacy is not a luxury, a technicality, or an afterthought. It is a democratic safeguard.

Unless personal data is governed lawfully, transparently, and accountably across the entire electoral cycle, elections risk becoming exercises in digital control rather than expressions of popular will.

Unwanted Witness is a leading civil society organization founded in 2012 to promote online freedoms and protect digital rights, with a core focus on building a safe, secure, and rights-respecting digital environment for citizens. While rooted in Uganda, the organization’s work extends across Africa, engaging regional and international actors on emerging digital rights and governance challenges. Unwanted Witness is widely recognized as a leading voice on internet freedom, privacy, digital identity, digital inclusion, and freedom of expression, and works to hold both public and private actors accountable for digital rights violations. It is the convener of flagship continental initiatives including the Privacy Symposium Africa, the Unwanted Witness Privacy Moot Court Competition, and the author of the Privacy Scorecard Report, which assesses data protection and privacy practices across jurisdictions. The organization advances its mission through evidence-based research, strategic advocacy, and capacity building, including documenting digital rights violations, driving policy and legal reforms, and providing digital security training and support to human rights defenders, journalists, and vulnerable communities to enable the safe, secure, and effective use of technology.