Uganda passenger data record

Data protection law and regulator

The Data Protection and Privacy Act, 2019 is Act 9 of 2019 and received assent on 25 February 2019 ¹. Section 4 establishes a personal data protection office under the National Information Technology Authority, Uganda, and the office reports to the Authority's Board ¹.

Section 29 requires every person, institution or public body that collects or processes personal data to register with the Authority, stating the purpose ¹. Section 30 makes the register open to inspection by any person ¹. Section 19 says a controller or processor that stores personal data outside Uganda must make sure the other country has adequate protection, or that the data subject has consented ¹.

The Act carves out border and security work in several places ¹. Consent is not needed where processing is authorised by law or is necessary for national security or for preventing, detecting or prosecuting an offence, under section 7(2) ¹. Section 18(2) says the limits on how long data may be kept do not apply to data kept for national security or crime purposes ¹.

API and PNR screening by customs

The World Customs Organization (WCO) reported that its staff visited Uganda Revenue Authority (URA) from 23 to 26 October 2017 and launched the first pilot of the Global Travel Assessment System (GTAS) ⁸. GTAS is passenger risk assessment software that the WCO offers to member customs administrations free of charge ⁸. The visit covered the National Targeting Centre in Kampala and passenger processing at Entebbe International Airport ⁸. US Customs and Border Protection supported the visit ⁸.

On 31 January 2020 the WCO reported that URA Commissioner General Doris Akol had announced the launch of GTAS on 27 January ⁹. The WCO said GTAS collects and analyses API and PNR data so officers can assess passengers before arrival ⁹. The pilot team worked with the Civil Aviation Authority, airlines operating in Uganda and a data service provider ⁹. The WCO did not name the provider or state where the data is hosted ⁹.

A UN Countering Terrorist Travel Programme presentation of 4 March 2025 lists Uganda among 31 African beneficiary states of its API and PNR support ¹⁰. We found no published Ugandan regulation that sets API or PNR data fields, retention periods or airline penalties ^1,6.

Immigration agency, e-visa and e-passport

The immigration website names the agency the National Citizenship and Immigration Control and describes it as a public service institution under the Ministry of Internal Affairs ⁴. The site uses the older name DCIC in places. It links to an online visa and permit system at visas.immigration.go.ug and a passport portal at passports.go.ug ³.

The Uganda Embassy in Berlin says Uganda set a two-year transition for phasing out machine-readable passports, and valid ones could be used until January 2021 ⁵. The new East African e-passport has an embedded chip ⁵. Applicants apply online, supply a national ID copy or a NIRA confirmation letter, and pay UGX 250,000 for an ordinary 48-page passport ⁵.

The Ministry of Internal Affairs statistical abstract, published June 2024, names PISCES, MIDAS and e-visa as border management systems that improved data capture ⁶. It records 1,791,719 arrivals and 2,196,514 departures in financial year 2022/23 ⁶. It reports 174,753 travel documents issued in one table and 267,554 passports issued in a trend figure for the same year, without explaining the gap ⁶.

Official records on gaps

In the foreword of its June 2024 abstract, the Ministry of Internal Affairs says some data capture is automated but much data is still handled manually ⁶. Parliament reported that on 31 March 2026 ministry officials told a committee that 19 of 72 gazetted border points were unmanned and only 33 percent had ICT coverage ⁷. Dr. Stephen Okello told the committee this was a gap to national security ⁷.

At the same hearing committee chair Wilson Kajwengye asked for an update on a joint venture with a private contractor to set up passport printing facilities ⁷. The report did not name the contractor or give contract terms ⁷. We found no audit office or regulator finding on passenger data systems.

Chronology