Uganda’s 2026 general elections have come and gone. President Yoweri Kaguta Museveni has been sworn in for another term. The international observer missions have issued their statements — some condemning the process, others offering measured acknowledgment of a flawed exercise. But beneath the headlines about political arrests, internet shutdowns, and contested results lies a quieter but perhaps more consequential story: what happened to the personal data of millions of Ugandan voters.
A new report by Unwanted Witness, a Kampala-based digital rights organization, documents how personal voter data — collected and stored by the Electoral Commission ahead of the elections — was systematically misused, shared with third parties, and in some cases, weaponized for political purposes. The report, titled “The Missing Piece of Electoral Integrity,” describes a pattern of data manipulation that has left Ugandans more exposed than ever before.
## How Voter Data Became a Political Weapon
In the lead-up to the elections, the Electoral Commission spent months collecting and verifying voter registration data — biometric information, home addresses, phone numbers, and in some cases, national identification numbers. This data, under Ugandan law, is supposed to be protected under the Data Protection Act of 2022. In practice, according to Unwanted Witness’s findings, it was anything but.
The report documents cases where voter data was accessed by political actors not affiliated with the Electoral Commission. Phone numbers were used to send targeted political messages — some threatening, some promotional. In at least one documented case, a voter in eastern Uganda received a text message threatening that her vote would be tracked and her family penalized if she voted for the opposition.
“Personal data was used to intimidate people in a way that directly compromised the integrity of the electoral process,” said the report’s lead author, who asked to remain anonymous for fear of retaliation. “This is not a technical violation. It is an attack on democracy itself.”
## The Legal Framework and Its Gaps
Uganda’s Data Protection Act of 2022 was hailed as a progressive step when it was passed. It established the Office of the Data Protection Commissioner, created rules for how personal data could be collected and processed, and set penalties for violations. But as the 2026 elections have demonstrated, having a law on paper and having it operational in practice are two very different things.
The Electoral Commission was not, under the law, authorized to share voter data with political parties or government agencies. Yet evidence compiled by Unwanted Witness suggests that such sharing occurred. The Data Protection Commissioner, meanwhile, has been criticized for inaction — lacking both the resources and the political independence to investigate complaints in a meaningful way.
“This is what happens when you have a law without enforcement,” said another digital rights advocate in Kampala. “The data was there, the rules were there, but nobody to enforce the rules. And so the powerful used it as they wished.”
## The International Dimension
Uganda’s data democracy crisis has not escaped the notice of international bodies. The International Commission of Jurists (ICJ), in a February statement, called for investigations into election-related violations — including what it described as “the weaponization of personal data for political purposes.” The African Commission on Human and Peoples’ Rights has also raised concerns about the Electoral Commission’s data management practices in its private deliberations.
But international statements have done little to reverse the damage. Once voter data has been accessed and misused, the exposure is permanent. The individuals whose information was compromised cannot un-ring that bell. And as Uganda moves into another five-year cycle, the same data infrastructure remains in place — without meaningful reform.
## What Needs to Happen
Civil society organizations and opposition politicians have made several demands: a comprehensive audit of the Electoral Commission’s data systems, an independent investigation into who accessed voter data and for what purposes, a public awareness campaign to inform voters of the risks they face, and — most fundamentally — structural reforms to how electoral data is collected, stored, and accessed.
The Electoral Commission has not publicly responded to the Unwanted Witness report. Government officials have dismissed the findings as politically motivated. But advocates say the silence is itself an answer.
Uganda has held elections in an environment of restricted civic space for years. What the 2026 cycle added was a new dimension of vulnerability — one that extends beyond the ballot box and into the daily lives of citizens who trusted the state with their most personal information. Until that trust is restored — or at least until it is shown to be warranted — the credibility of Uganda’s democratic processes will remain permanently impaired.