Uganda’s Digital Economy: Rights Trends, Regulatory Gaps and Policy Responses

By Doreen Elizabeth Namuyanja |

Uganda’s digital economy is expanding rapidly across finance, transport, agriculture, commerce, healthcare and public-service delivery. However, this growth is outpacing the legal, regulatory and institutional safeguards needed to address emerging concerns around personal and biometric data, artificial intelligence, platform work, digital exclusion and internet shutdowns.

Drawing on a 2025 survey, two commentaries and a policy submission by CIPESA, this policy brief examines Uganda’s evolving digital business landscape, business data practices, the future of work and the impact of internet disruptions. It highlights the gaps between technological advancement and effective governance and proposes actions for government, businesses, private sector associations and civil society to build an inclusive, resilient, and rights-respecting digital economy.

The brief finds that Uganda has established important legal protections, including the Data Protection and Privacy Act of 2019. The principal challenge, however, is implementation, enforcement, and the ability of regulatory and institutional frameworks to adapt to rapidly evolving technologies and business models. Businesses frequently collect personal and biometric data without sufficiently explaining how it will be used, stored, shared, or deleted. Meaningful consent, data security, and effective retention and deletion practices also remain inconsistent, particularly among businesses with limited compliance capacity.

These gaps have consequences beyond privacy and individual rights. Weak data governance can undermine trust in digital services, while inadequate safeguards for platform workers and persistent digital exclusion can limit who benefits from the digital economy. Internet shutdowns pose a broader threat, disrupting digital financial services, e-commerce, public services and other activities that increasingly depend on reliable connectivity.

The brief calls for coordinated action by government, businesses, private sector associations and civil society to:

Businesses

  • Strengthen data governance and informed consent: implement collection and processing frameworks built on explicit, freely given consent, backed by clear, accessible privacy notices.
  • Improve data security and lifecycle management: adopt encryption, regular security audits, and clear retention, deletion and minimisation policies.
  • Build organisational compliance capacity: appoint and train Data Protection Officers, embed privacy-by-design into product development, and run regular staff training on data protection, cybersecurity and phishing risks.
  • Strengthen digital resilience: develop business continuity plans for internet disruptions, and collaborate with civil society and legal actors to promote an open, secure and reliable internet.

Government of Uganda

  • Strengthen enforcement of the data protection framework by adequately resourcing the Personal Data Protection Office (PDPO) and other regulators to conduct audits, investigate violations, and impose proportionate sanctions.
  • Modernise the legal and policy framework to address biometric data, AI and platform work, aligned with constitutional and international human rights standards, and issue practical, sector-specific guidance to help businesses, particularly SMEs, comply.
  • Promote digital inclusion and public awareness through sustained education campaigns, including in local languages, and continued investment in affordable infrastructure and digital skills.
  • Safeguard the digital economy against internet disruptions by developing clear legal safeguards against shutdowns and ensuring any restrictions comply with constitutional and international human rights obligations.

Private Sector Associations

  • Build members’ capacity through regular training on data protection, cybersecurity, AI governance and business continuity planning.
  • Promote industry standards and peer learning by developing model policies and compliance toolkits for consistent implementation across member organisations.
  • Support risk management by encouraging periodic risk assessments among members and facilitating the sharing of lessons learned and mitigation strategies.

Civil Society Organisations

  • Strengthen multi-stakeholder collaboration among government, businesses, academia and technical experts on data protection, AI governance and digital rights.
  • Promote public awareness and digital rights literacy through accessible educational materials and community outreach.
  • Undertake research and evidence-based advocacy on biometric data governance, AI, platform work and internet shutdowns, including documenting their social, economic and human rights impacts, to support stronger legal frameworks and strategic litigation.
  • Support business compliance and resilience by developing practical guidance, templates and capacity-building support on responsible data governance.

Read the full brief here.

Applications are Open for a New Round of Africa Digital Rights Funding!

Announcement |

The Collaboration on International ICT Policy for East and Southern Africa (CIPESA) is calling for proposals to support digital rights work across Africa.

This call for proposals is the 10th under the CIPESA-run Africa Digital Rights Fund (ADRF) initiative that provides rapid response and flexible grants to organisations and networks to implement activities that promote digital rights and digital democracy, including advocacy, litigation, research, policy analysis, skills development, and movement building.

 The current call is particularly interested in proposals for work related to:

  • Data governance including aspects of data localisation, cross-border data flows, biometric databases, and digital ID.
  • Digital resilience for human rights defenders, other activists and journalists.
  • Censorship and network disruptions.
  • Digital economy.
  • Digital inclusion, including aspects of accessibility for persons with disabilities.
  • Disinformation and related digital harms.
  • Technology-Facilitated Gender-Based Violence (TFGBV).
  • Platform accountability and content moderation.
  • Implications of Artificial Intelligence (AI).
  • Digital Public Infrastructure (DPI).

Grant amounts available range between USD 5,000 and USD 25,000 per applicant, depending on the need and scope of the proposed intervention. Cost-sharing is strongly encouraged, and the grant period should not exceed eight months. Applications will be accepted until November 17, 2025. 

Since its launch in April 2019, the ADRF has provided initiatives across Africa with more than one million US Dollars and contributed to building capacity and traction for digital rights advocacy on the continent.  

Application Guidelines

Geographical Coverage

The ADRF is open to organisations/networks based or operational in Africa and with interventions covering any country on the continent.

Size of Grants

Grant size shall range from USD 5,000 to USD 25,000. Cost sharing is strongly encouraged.

Eligible Activities

The activities that are eligible for funding are those that protect and advance digital rights and digital democracy. These may include but are not limited to research, advocacy, engagement in policy processes, litigation, digital literacy and digital security skills building. 

Duration

The grant funding shall be for a period not exceeding eight months.

Eligibility Requirements

  • The Fund is open to organisations and coalitions working to advance digital rights and digital democracy in Africa. This includes but is not limited to human rights defenders, media, activists, think tanks, legal aid groups, and tech hubs. Entities working on women’s rights, or with youth, refugees, persons with disabilities, and other marginalised groups are strongly encouraged to apply.
  • The initiatives to be funded will preferably have formal registration in an African country, but in some circumstances, organisations and coalitions that do not have formal registration may be considered. Such organisations need to show evidence that they are operational in a particular African country or countries.
  • The activities to be funded must be in/on an African country or countries.

Ineligible Activities

  • The Fund shall not fund any activity that does not directly advance digital rights or digital democracy.
  • The Fund will not support travel to attend conferences or workshops, except in exceptional circumstances where such travel is directly linked to an activity that is eligible.
  • Costs that have already been incurred are ineligible.
  • The Fund shall not provide scholarships.
  • The Fund shall not support equipment or asset acquisition.

Administration

The Fund is administered by CIPESA. An internal and external panel of experts will make decisions on beneficiaries based on the following criteria:

  • If the proposed intervention fits within the Fund’s digital rights priorities.
  • The relevance to the given context/country.
  • Commitment and experience of the applicant in advancing digital rights and digital democracy.
  • Potential impact of the intervention on digital rights and digital democracy policies or practices.

The deadline for submissions is Monday, November 17, 2025. The application form can be accessed here.

NEW BRIEF: Policy Considerations for Enhancing Digital Trade in East Africa

By Lillian Nalwoga |

The East African region is on the cusp of a digital revolution, with significant strides being made in digital trade and payments. This is driven by remarkable growth in internet penetration, mobile money services, and the adoption of emerging technologies like 5G and Artificial Intelligence (AI).

Further, initiatives such as the African Continental Free Trade Area (AfCFTA) and the East African Community (EAC) e-Commerce Strategy are laying the groundwork for a thriving digital economy. The World Bank projects digital services exports from Africa to reach USD 74 billion by 2040, highlighting the immense opportunity at hand. Despite these strides, there are several key challenges that need to be addressed to fully unlock the region’s digital potential.

In this brief, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) outlines barriers to digital trade and presents key policy recommendations for promoting a human rights-based digital economy in the region.

According to the brief, the key barriers hindering the advancement of digital trade in East Africa include:

  • Limited Digital Infrastructure and Internet Access: While mobile internet penetration is growing, issues like internet subsea cable cuts, network disruptions, low digital literacy, and low affordability persist. Uneven distribution of infrastructure, high deployment costs, and slow adoption of new technologies further exacerbate the digital divide.
  • Fragmented Approaches to Digital Economy Taxation: Differing digital service taxes (DST) across countries create complexities and may impede innovation and cross-border trade. Kenya, Uganda, and Tanzania all levy DST, with Kenya’s rate being the highest in the region.
  • Data Governance and Privacy Concerns: While some countries have adopted data protection laws, harmonise action is lacking. Issues like data localisation requirements and the need for a comprehensive regional approach to data privacy and management remain.
  • Limited Local Data Centres: The region has a limited number of data centres, which hinders data localisation efforts and the advancement of AI and other data-intensive technologies. Restrictive regulatory frameworks in some countries further complicate the use of cloud solutions.
  • Rising Cybersecurity Threats: Cyber risks are a major concern, with increasing cyber attacks targeting various sectors. Cybercrime laws, while necessary, sometimes contain vague provisions that can be used to curtail online freedoms.

To overcome these challenges and fully leverage the digital economy, the policy brief offers several key recommendations:

  • Embrace Digital Transformation and Connectivity: Invest in robust networks, backup systems, and address single points of failure in internet connectivity.
  • Implement Robust Cybersecurity Frameworks: Prioritise investments in cyber infrastructure, skilling, and awareness.
  • Recognise Data as a Trade Enabler: Ensure trade agreements prevent unnecessary restrictions on data flows and adopt balanced data localisation policies.
  • Harmonise Data Protection Standards: Reduce compliance costs and build trust by harmonising data protection standards across the region.
  • Build Robust Digital Infrastructure: Focus on Digital Public Infrastructure (DPI), data policy, privacy, and protection.
  • Speed up the Adoption of the EAC Data Governance Policy Framework: Secure resources for its implementation.
  • Assess and Address the Impact of Emerging Technologies: Ensure policies foster innovation while addressing ethical and legal challenges.

The East African region has the potential to become a major player in the global digital economy. By addressing the existing barriers and implementing these recommendations, the region can create a thriving digital ecosystem that benefits all its residents.

Read the full brief here.

Digital Taxation Doing More Harm than Good for Access and Rights in Africa

By Evelyn Lirri |

When Uganda introduced a tax on social media use in 2018, the government hoped the new source of revenue would help widen the country’s tax base. Instead, internet subscriptions fell drastically and the government did not raise the anticipated revenue as most users turned to Virtual Private Networks (VPNs) to access social media platforms. 

Three years later in July 2021, Uganda abandoned the levy on social media access and instead introduced a 12% tax on internet data. Still in its early days, the effects of the new tax are yet to be seen. Nonetheless, like its predecessor, the tax is likely to affect internet access, the country’s fledgling digital economy, and digital civic space. 

Yet Uganda is not alone in the growing trend of digital taxation. From South Africa in the south, Kenya and Tanzania in the east, through to Nigeria in the west, as the Information and Communications Technology (ICT) sector grows across the African continent, several countries are turning to the sector as a target for new revenue streams.

But there appears to be no stakeholder consensus on digital tax rules, with activists, economists, technologists and innovators at loggerheads with tax bodies and communications regulators on how to overcome economic downturns while driving digital transformation and upholding digital rights.   

This balancing act formed the basis of a recent workshop on the impact of digital taxation on digital rights in Africa organised by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA). The workshop brought together 66 participants from across the continent and beyond to deliberate on good digital taxation practices and the impact of taxation on users and national ecosystems. The workshop featured perspectives from platform operators, national and regional regulatory bodies, tax authorities, and policy makers. 

Speaking at the workshop, Professor H Sama Nwana, a technology and telecommunications consultant affiliated with the UK-based Cenerva, said digital taxes in various forms are not only regressive, they disenfranchise poor and marginalised groups such as women and the youth. “If you apply a flat tax, it is going to affect the less privileged and people who need the internet the most, such as women in rural areas. The social media tax in Uganda impacted some of the poorer provinces more than people in urban areas such as the capital Kampala,” he explained.

According to Nwana, countries which have introduced digital taxes have registered a subsequent decline in the number of people accessing and using the internet and other ICT-related services, ultimately leading to less revenue generated for the government. “This is paradoxical because when you try to drive up your tax revenue by putting up more taxes onto the system, people stop using data services to transact or carry out other businesses such as agriculture and financial services,” said Nwana.

Access to affordable internet is still a challenge for many across the continent. With just over a quarter of the population online, additional costs including taxes deepen the affordability challenge. Indeed, as the Alliance for Affordable Internet (A4AI) Africa Regional Coordinator Onica Makwakwa argued, “taxes that are passed on to consumers further burden those who are already struggling with the cost of access” and it is thus crucial to “guard against over-taxation” especially in light of the Covid-19 pandemic which has made the need to be connected and have access to affordable internet even “more urgent”. 

“What we have in Africa is an affordability and accessibility gap which needs to be closed,”  said Dr. Christoph Stork, a telecommunications expert with Research ICT Solutions. “To be able to provide e-services such as health, education and fintech, we need increased connectivity. ICT taxes make these services either too expensive or less attractive to invest in.”

Taxation, according to Stork, should be broad-based, easy to enforce, provide incentive for competition and investment, and be progressive. “The [Uganda] Over the Top Services (OTT) tax, for example, is regressive because everyone pays the same amount regardless of whether they are rich or poor. These kinds of taxes in general prevent the poor from participating in tomorrow’s internet society,” Stork said. 

Reducing or eliminating sector-specific taxation therefore becomes critical to encourage investment in mobile connectivity, improved affordability, increased uptake, and ultimately, economic growth.

The CIPESA Programme Manager, Ashnah Kalemera, cited the example of Chad, a country with one of the lowest internet and mobile penetration rates on the continent and a history of restricting citizens’ access to internet platforms, which in January 2020 eliminated an 18% excise duty on mobile internet to facilitate increased access and usage of data by citizens. On the other hand, in countries such as Malawi, where telecommunications operators have over recent months made strides in lowering the cost of data services, Kalemera said the government maintains various ICT-related taxes that continue to affect affordability. 

Nwana said research shows that for every 10% increase in mobile broadband penetration, there is an increase of between 0.82 to 1.4% in Gross Domestic Product (GDP) of developing countries in Africa. He added: “Why do we want to forego this growth by increasing taxes which drops the number of people using broadband data services, which clearly adds significant value and GDP growth to our economy?”

The digital tax debate has also featured discussions around how African governments can derive revenue from big multinational companies such as Facebook which are domiciled abroad but have a significant number of users on the continent. 

Jacob Puhl, Manager of Tax Policy at Facebook, noted that while the social media platform generates about 98% of its revenue from advertising, only about 8-9% of that revenue comes from emerging economies in Africa and Asia. “People keep asking, ‘you have users here, why don’t you pay taxes?’ Because users of our platform are all over the world, there is a lot of misunderstanding about where our revenues come from as well as our advertisers. Advertisers pay more to reach markets where e-commerce is robust,” said Puhl.

Audience Q&A

Participant: It is true that Facebook is an advertising company based in the USA and that most users are not Facebook customers. However, take an advertiser like Coca-Cola. Their product is consumed in most countries in the world and so they advertise with Facebook because of those users who pay nothing to Facebook.

Response: In the 80+ countries where VAT is applied to ads purchased from non-resident companies, Coca-Cola would pay VAT to Facebook and we would remit it to the tax administration.

Indeed the impact of taxation on e-commerce platforms was highlighted as part of the workshop’s deliberations. For instance, according to Ron Kawamara, the Chief Executive Officer (CEO) Jumia-Uganda, the introduction of the OTT tax led to a decline in the number of vendors and customers on their platform despite the potential that e-commerce presents for the country and continent. 

“Before the tax, we had a reach of about 11 million users on Facebook. That dropped by 35% with the introduction of OTT. And with users turning to VPN, it becomes difficult to reach customers with one service or the other,” said Kawamara.

Jumia Uganda is a subsidiary of the pan-African e-commerce company Jumia Group, which is Africa’s largest online retailer. Launched in 2012, it currently has operations in 11 African countries as well as China, United Arab Emirates and Portugal. 

While e-commerce platforms can be catalysts for revenue generation for governments, the lack of visibility of some of the platforms has made it difficult for tax bodies to properly track and ensure tax compliance. This, according to Milly Nalukwago Isingoma, the Assistant Commissioner Research, Planning and Development at Uganda Revenue Authority (URA), has impacted how much revenue the government is able to generate from online platforms and businesses. 

“With the previous model of taxation, you had to have a physical address where you could reach the taxpayer. Now transactions are happening online with no visibility and our collections have remained low. This is what forced us to come up with taxes such as the OTT tax,” said Isingoma. 

Isingoma acknowledged that implementing the tax was difficult and less revenue than had been projected was collected. “We do acknowledge that we got it wrong with the OTT tax. That is why we decided to work with the telecom companies to come up with the 12% excise duty that cuts across. This way, we are also able to protect the revenue base of the telecom companies,” said Isingoma. 

Dr. Peter Mwencha, Director at Consumer Unity & Trust Society-Africa Centre, called for an update to tax laws on the continent in order to protect consumers and integrate the digital economy. Similarly, James Mutandwa Madya, the Director for Policy and Strategic Planning at the ICT ministry in Zimbabwe, noted that in order to address some of the challenges and limitations of digital taxation, tax models should be reviewed with the interests of governments and consumers taken into account. 

Creating this balance requires collaboration between regulators and tax bodies, according to  Anthony Marufu Chigaazira, the former Executive Secretary of the Communications Regulators Association of Southern Africa (CRASA). “Collaborative regulation should be at the forefront otherwise we end up with tax authorities who do not understand the sector proposing taxes that infringe on digital rights and impact the majority of the population,” said Chigaazira. 

Indeed, as noted by Pria Chetty, Director of the South Africa-based EndCode, it would be instructive to understand the trajectory of models informing specific digital tax approaches in different countries. According to her, “it would be too simplistic” to consider the motivation for digital taxes as merely a government “grab” for new taxation sources. 

Chetty added that instances where digital taxes have been withdrawn, including outside the continent, should offer learning to African regulators. “Regional and continental guidance on taxation that accounts for the unique costs of connectivity and unique value chains should also be a priority. National approaches should account for the state of the digital economy, existing tax structures, fundamental rights and competition dynamics,” said Chetty.

Resources:

New Tax on Online Services A Threat to Internet Freedom in Mauritius

By Thomas Robertson |

Under the premise of Covid-19 austerity measures, the government of Mauritius passed a new tax on digital services in August 2020. The “Liability to Value Added Tax on Digital and Electronic Services” is one of the several amendments to the Value Added Tax (VAT) Act introduced in the July 2020 Finance Bill.

The Act defines “digital or electronic service” as any service supplied by “a foreign supplier over the internet or an electronic network which is reliant on the internet; or by a foreign supplier and is dependent on information technology for its supply.”

The penalties for failure to comply with VAT that are outlined in the original VAT Act (which are unchanged in the amendment that extended the tax to digital services) include a fine of up to 50,000 rupees (USD 1,255) or imprisonment of up to five years.

The digital VAT introduction is the latest in Mauritius’ move towards internet regulation that has already manifested in restrictions to freedom of expression through the Information and Communication Technology (ICT) Act and application of expanded surveillance technologies in tourist areas.

The Bumpy Legal Road to Mauritius’ Blossoming ICT Sector

 Mauritius’ economic success and a strong culture of democracy have allowed for the development of an emerging ICT sector. In 2019, the ICT sector contributed up to 5.8% to the country’s Gross Domestic Product (GDP) amounting to over 800 million US dollars. This is not surprising given that Mauritius has set out to be the world’s first Cyber Island and has fulfilled that goal by establishing Africa’s first Cybercity. Additionally, a conducive legal framework is in place, including laws on cybercrime, data protection, and ICT usage regulation and democratisation. Mauritius is also implementing a 2018-2022 Digital Government Strategy that aims to integrate technology into government operations and service delivery.

Nonetheless, there has been a series of regressive developments to which the online services tax now contributes. In 2018, a contentious amendment to the ICT Act was passed, which criminalised content perceived to cause “annoyance, humiliation, inconvenience, distress or anxiety to any person,” and established penalties of up to 10 years in prison. However, even before the amendment of the ICT Act, two internet users were arrested in 2016 following a complaint filed by a member of the Mauritian cabinet regarding their Facebook posts. One of the two users arrested in 2016, Farihah Ruhomaully, was arrested again in July 2020 after she called a Member of Parliament a “dirtbag” on Facebook. Both of these arrests were justified as responding to breaches of the ICT Act, indicating that the Act is enforced not just to prevent cybercrime, but also to crack down on dissent.

The ICT Act has also been used to criminalise the dissemination of false news as demonstrated by the arrest of a former government minister on allegations of spreading false information regarding the purchase of Covid-19 medical equipment. Meanwhile, there are reports of the involvement of the Mauritian government in the blockage of social media accounts of critics on grounds of national security.

In addition, the Mauritian government is one of several across Africa to institute a widespread surveillance apparatus. The Safe City project funded by Huawei will install a system of hundreds of closed circuit television (CCTV) cameras in the Port-Louis area purportedly intended to fight crime. This is troubling given Huawei’s reported collaboration with state police forces in Uganda and Zambia to target the political opposition.

Looking Beyond the Tax Act’s Impacts on Internet Affordability and Free Speech

Mauritius boasts relatively high internet access rates compared to much of sub-Saharan Africa – 59% internet penetration as of 2018, according to the World Bank and the International Telecommunication Union. The country is also ranked favourably in internet affordability by the Alliance for Affordable Internet (A4AI) Affordability Report: 13th out of 61 countries assessed worldwide and first in Africa.

Without a list of the range of digital services under the scope of the new VAT provisions, it is unclear which services will be affected, though Netflix and Google Drive are among the services speculated to be taxed. At 15% of the value of “digital or electronic services”, the levy will likely increase the price of affected services – putting them out of reach for many Mauritians. Indeed, similar VAT modifications on online services in Mexico and Chile demonstrate the effects of the increased tax burden on consumers.

With a strong history of democracy and rule of law, legislative constraints that stifle free speech online and expand surveillance show regression into authoritarianism. The introduction of VAT on online services resembles the likes of the Ugandan government’s social media tax and the Zambian government’s  tax on internet voice calls. The timing of the tax also seems peculiar given that many Mauritians are relying on digital services during the Covid-19 pandemic. Furthermore, digital platforms have recently been utilised to mobilise opposition against the Mauritian government’s response to the Wakashio oil spill, resulting in over 50,000 citizens participating in an anti-government protest in August 2020.


Thomas Roberston is a 2020 CIPESA Fellow focussing on digital expression and China-Africa relations.