Promoting Effective and Inclusive ICT Policy in Africa

Tag Archives: surveillance

  HomeCollaboration on International ICT Policy for East and Southern Africa (CIPESA)  /  surveillance
01Jul

Navigating Digital Rights in Africa amidst Increasing Foreign Malign Influence

Author CIPESA Posted on

By CIPESA Writers | 

On May 21, 2026, more than 300 delegates convened in Nairobi, Kenya, for the 19th edition of the Kenya Internet Governance Forum (KeIGF) to discuss the state of digital rights and internet governance on the continent.

The KeIGF was held three weeks after the continent’s digital landscape was jolted by the Zambian government’s decision to postpone RightsCon, the global digital rights forum, four days before it was scheduled to start. Efforts to resolve the issue yielded no positive results, and Access Now, the event organiser, decided to cancel the conference.

According to the Access Now statement, officials in Zambia’s Ministry of Technology and Science had reached out to them with concerns raised by diplomats from the People’s Republic of China, who were “pressuring” the Zambian government over the planned in-person participation of Taiwanese civil society.

Proceeding with the event while excluding some participants at the behest of certain countries would have set a bad precedent. The RightsCon cancellation, however, had a ripple effect, with several in-person sessions of the World Press Freedom Day 2026 Global Conference, which coincided with RightsCon, being cancelled, while others were rescheduled to later dates.

These events highlight the growing influence of national governments on the success or failure of regional and international digital rights convenings. As Access Now explained, such convenings often involve extensive diplomatic engagement between conference organisers and host countries to secure their commitments, among other things, to respect the fundamental human rights of all participants and to ensure smooth logistical preparations. For example, in March 2026, the Zambian Ministry of Technology and Science issued a statement announcing that the government would be a co-host of the RightsCon conference.

Access Now’s decision was a timely reminder that fundamental human rights, including digital rights, are non-negotiable and interdependent, and that national governments should not be at liberty to choose which rights to respect.

Growing Incidents of Foreign Malign Influence in Africa

Foreign governments’ interference in the internal affairs of African countries is not new, and while incidents of foreign malign influence in Africa’s trajectory toward digital authoritarianism have been well documented, the RightsCon cancellation was possibly the first time a foreign entity worked so blatantly to influence the direction of a digital rights convening itself. This clearly demonstrated the dangers posed by the growing economic and power imbalances between African countries and their trading partners.

Because many African countries have turned to China and Russia for support for their economic and security agendas, respectively, they have inadvertently surrendered part of their sovereignty to these superpowers due to what is referred to as the “debt trap”. 

For example, in April 2026, China was reported to have scrapped tariffs on all African countries except Eswatini, which maintains diplomatic relations with Taiwan, a move that contributed to friction between Access Now and the Zambian government. Earlier in 2022, the Chinese government was reported to have “forgiven” 23 interest-free loans to 17 African nations after it had also cancelled more than USD 3.4 billion in debt and restructured around USD 15 billion in debt in Africa between 2000 and 2019.

Reports by the Institute for Security Studies (ISS) and the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) have shown that geopolitical interests have often crossed national boundaries, with powerful nations exerting influence on the legal landscapes and digital public infrastructure of many African countries. 

According to an Institute of Development Studies study that mapped smart surveillance technologies in 11 African countries, many African countries that have embraced smart city surveillance have tended to rely on China for financing their digital public infrastructure, including tools, software, and capacity-building, which are often deployed to conduct digital surveillance of their citizens. Digital rights actors and individual government critics have often borne the brunt of these surveillance practices.

Unfortunately, the deployment of these digital surveillance tools and software is often characterised by limited oversight and a lack of transparency regarding their purchases and operations, raising serious concerns about their intentions and their impact on human rights. 

In April 2026, a team of United Nations Experts raised serious concerns about the proliferation of digital surveillance technologies, including artificial intelligence (AI), noting that their misuse by states in law enforcement, counter-terrorism, border management, and national security and military contexts poses serious human rights risks. 

Disinformation and Information Warfare

Africa has also become a battlefield for disinformation campaigns as different superpowers scramble to expand their spheres of influence. Foreign disinformation campaigns are particularly prominent during periods of contestation, such as elections, protests, and civil strife. 

Because they are more covert, disinformation campaigns have become more insidious as they are rarely noticeable or easily associated with foreign actors. For example, in countries such as Kenya, Ethiopia, Ghana, and Nigeria, Russia has worked with locally based influencers and digital content creators to amplify pro-Kremlin narratives and messaging while keeping their connections to Russian-backed initiatives a secret. 

In 2024 alone, there were at least 80 documented cases of Russian-linked disinformation campaigns targeting more than 22 African countries. Indeed, several of Africa’s fragile autocracies, such as Burkina Faso, the Central African Republic (CAR), Mali, and Sudan, have come to rely on Russia’s well-coordinated digital propaganda to sustain their stay in power. 

Mitigating the Malign Influence

Foreign malign influence has continued to thrive in Africa, partly due to African countries’ overreliance on the “generosity” of superpowers seeking to shape Africa’s political, social, and economic landscape. While development partnerships and support are critical to a country’s development, these should be anchored in rights-respecting frameworks and geared towards benefiting ordinary citizens.

Taken together, the various aspects of foreign malign influence are undermining the democratic practices of many African countries, including electoral processes, while emboldening autocratic leaders to embrace digital authoritarianism.

For digital rights activists, especially in Africa, it is therefore important to understand and address the factors driving the expansion of foreign digital malign influence and to develop strategies to counter it, including mechanisms to hold governments accountable when they purchase and deploy digital surveillance tools and software. 

More specifically, digital rights actors should:

  • Strengthen Digital and Media Literacy

Because foreign malign influence most often thrives in contexts with limited media and information literacy, weak media systems, and digital inequalities, it is important that rights actors build systems that promote information integrity, such as media independence, fact-checking, and independent journalism, to counter information manipulation. In most of Africa, the media and information ecosystems are so integrated, enabling the viral spread of misinformation through influencers and digital content creators with large followings. Quite often, media houses amplify the disinformation tapped from influencers with large followings without verification.  

  • Build Stronger Coalitions and Regional Networks

In many African countries, governments have often used the tried-and-tested “divide and rule” approach, mischaracterising digital rights actors as either sympathetic to them or “enemies”. The main purpose is always to isolate certain actors deemed too critical. 

To mitigate the risks associated with engaging with less democratic governments, digital rights actors should aim to build synergies and support systems, ensuring that collective voices among like-minded organisations, such as academia, media, and telecom companies, can, among other things, challenge government excesses. This could include issuing joint statements, which is critical as it does not expose any entity; and providing technical and financial assistance to more at-risk organisations. 

  • Leverage Digital Rights Convenings

Digital rights convenings such as the Forum on Internet Freedom in Africa (FIFAfrica) and Internet Governance Forum have become strategic platforms for digital rights advocacy and engagements, especially with national governments. It is therefore important that digital rights actors use these platforms to continuously ask duty bearers the hard questions regarding the conduct of due diligence reports on any technologies imported into the continent and their impact on fundamental human rights. 

For example, Africa will host several international and regional digital rights convenings, including the 21st Global Internet Governance Forum, which will be held in Kenya in December 2026, the fourth time the event will be held on the continent. In September, Mauritius will host the 13th FIFAfrica edition, while Ghana will host the 15th Annual Africa Internet Governance Forum in November 2026. 

These events present great opportunities for digital rights actors to reflect on Africa’s digital rights record and the progress made so far, and to table concrete African positions on digital rights, including data sovereignty, Artificial Intelligence, and platform accountability.

23Jun

Towards Regulation of App-Based Health Data in Africa

Author CIPESA Posted on

By Edrine Wanyama |

Digital health technologies are reshaping healthcare delivery across Africa. App-based systems now connect patients, clinicians, pharmacies, laboratories, and public health agencies, creating new opportunities to improve access, efficiency, and coordination of care. At the same time, they generate large volumes of highly sensitive health data, much of it moving across platforms, providers, and in some cases, national borders.

A new Policy brief by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) examines the critical need for robust governance of app-based health data in Africa.

The brief highlights significant health data governance gaps, which include the lack of health-specific AI regulation, fragmented legal, policy and institutional frameworks, and the unresolved distinction between wellness tracking and clinical care. These gaps fundamentally undermine health data handling and management standards, with flaws in consent, accountability, and cross-border data management requirements.

Across the continent, digital health applications now span multiple functions within health systems, from clinical management systems and electronic medical records (EMR) platforms to pharmaceutical logistics and supply chains. Alongside these systems, AI-enabled and specialist care platforms are expanding diagnostic and treatment capacity. Patient-facing applications are also expanding, particularly in chronic care, maternal health, and home-based services.

While these innovations are improving access to services and efficiency, they also introduce significant governance risks. Health data is among the most sensitive categories of personal data, capable of revealing medical history, reproductive health, mental health status, and genetic information. In app-based systems, this data is often processed by multiple actors, including developers, health providers, cloud infrastructure providers, and third-party analytics firms, many of which are not visible to users.

In practice, consent is often weak or poorly understood, data sharing arrangements are opaque, and users have limited visibility or control over the use of their information. This creates risks not only to privacy, but also to trust in digital health systems.

These risks are compounded by fragmented legal and institutional frameworks. Although many countries have enacted data protection laws and digital health policies, enforcement remains uneven and coordination between health ministries, data protection authorities, and digital regulators is often weak. This creates a persistent governance gap between the rapid expansion of app-based health systems and the capacity of institutions to regulate them effectively.

At the continental level, emerging frameworks such as the Africa Centres for Disease Control and Prevention (CDC) and global guidance such as the World Health Organization (WHO) Digital Health Strategy set important normative directions for secure, rights-respecting health data governance. However, translating these commitments into enforceable national systems remains limited, particularly in relation to interoperability, cross-border data flows, and platform accountability.

The brief calls for the adoption of a strategic governance architecture grounded in seven data governance principles, namely:

  1. Data sovereignty that reflects African public health priorities, democratic oversight and defined accountability mechanisms;
  2. Cross-border data flows where adequate and comparable safeguards exist and support reciprocal recognition arrangements among Data Protection Authorities (DPAs);
  3. Consent, purpose limitation, and data minimisation that enable individuals to make informed decisions about participation and ensure secondary uses are subject to transparency and safeguards;
  4. Interoperability and standardisation of systems to ensure integration and portability;
  5. Governance of AI-based health tools that require algorithmic impact assessments, independent audits and ongoing monitoring;
  6. Equity and inclusion to ensure systems do not further exclude vulnerable and marginalised communities; and
  7. Accountability and institutional coordination through clear allocations of responsibilities across institutions, consistent oversight, enforcement, and compliance monitoring.

The principles are consistent with the CDC Health Data Governance Framework. Together with other continental instruments, they can support a harmonised, rights-respecting and secure health data governance in Africa.

The brief presents recommendations for various stakeholders which, if implemented, could foster a progressive and trustworthy digital health ecosystem in Africa. Among theses include:

For the African Union and Regional Bodies

  • Support implementation of the Africa CDC Continental Health Data Governance Framework through clear timelines, monitoring mechanisms, knowledge sharing platforms, and technical assistance for member states.
  • Develop a continental health-app certification framework, recognised across participating jurisdictions, covering consent requirements, interoperability standards, cybersecurity safeguards, data governance obligations, and algorithmic accountability.
  • Facilitate regional data trust zones through reciprocal recognition agreements among Data Protection Authorities, enabling secure and accountable cross-border health data flows for disease surveillance, research collaboration, and pandemic preparedness.

For National Governments and Health Ministries

  • Enact or strengthen health-specific data governance legislation that addresses the full data lifecycle in app-based health systems, including consent, purpose limitation, data minimisation, retention, breach notification, and cross-border transfers.
  • Establish regulatory sandboxes to assess the safety, effectiveness, and governance implications of emerging digital health technologies before large-scale deployment.

For  Data Protection Authorities

  • Conduct risk-based audits and impact assessments of high-impact health applications, including privacy, security, and algorithmic fairness, where AI systems are deployed.
  • Develop sector-specific guidance on the processing of health, biometric, and demographic data, including standards for research use, secondary use, and commercial processing.
  • Enter into reciprocal recognition arrangements with counterpart DPAs across Africa to support coordinated enforcement and trusted cross-border data flows.

For Health Service Providers

  • Formalise data processing agreements with health app vendors and third-party processors, including provisions on security, breach notification, audit rights, and liability.
  • Strengthen workforce capacity through regular training on health data governance, cybersecurity, incident reporting, and the responsible handling of sensitive health information.
  • Implement strong authentication, access-control, and encryption measures to protect patient information throughout its lifecycle.

For App Developers and Platform Operators

  • Embed privacy-by-design and security-by-design principles throughout the development, deployment, and operation of health applications.
  • Provide clear and accessible consent mechanisms that enable users to understand and control how their health data is collected, shared, retained, and reused.
  • Conduct regular testing and independent assessments of digital health tools to identify and address bias, accuracy concerns, and performance disparities across African populations.

For Health Service Consumers and App Users

  • Exercise rights over personal health data, including rights of access, correction, portability, and deletion where provided under applicable legal frameworks.
  • Use health applications that comply with relevant regulatory requirements and recognised data protection standards.
  • Report suspected data breaches, misuse of personal information, or harmful automated decision-making outcomes to relevant regulators and oversight bodies.

Please read the full Policy Brief here.

Donatien of the Integrated Refugee Organisation points to a flip-chart of verification tools while leading an OSINT session
20Jun

Building Digital Security and Verification Capacity Among Refugees

Author CIPESA Posted on

By Brian Byaruhanga |

In May 2026, CIPESA joined the World Organisation Against Torture (OMCT) and partners to conduct a three-day workshop on digital security and Open-Source Intelligence (OSINT) for Congolese human rights defenders and journalists  in exile in Uganda. 

The workshop addressed the various threats this community continues to navigate daily including account compromise, phishing-borne malware, surveillance by state and non-state actors, device confiscation, and exposure to coordinated disinformation operating across both home-country and diaspora information spaces.

The 23 participants were drawn from women’s rights organisations, community documentation initiatives, justice and accountability groups, and broader human rights defender (HRD) support structures. A pre-workshop participant assessment found that one in three respondents had received no prior digital security training, highlighting a significant gap between the threats faced and necessary skills and knowledge to mitigate them.

The findings underscored the need to begin with foundational digital security practices before moving on to more advanced verification and documentation techniques.

Reported incidents within the cohort included hacked accounts, phishing attempts, confiscation of phones by security agents, surveillance of digital communications, and impersonation. One respondent described documentation work conducted in close proximity to alleged perpetrators of human rights violations, with no possibility of relocating, and elevated personal risk attached to ordinary data collection. These conditions, common across conflict-affected zones as is the case in the Democratic Republic of Congo (DRC), shape the technical and ethical constraints under which any digital security training must be designed.

CIPESA’s contribution builds on the organisation’s broader work supporting at-risk communities across the region, including through the Level-Up programme, which has provided digital security support to HRD organisations in Kenya, Ethiopia, Tanzania, South Sudan, and Uganda.

It also draws on CIPESA’s wider efforts to strengthen the capacity of civil society actors to advance digital rights in Africa. Across these engagements, a consistent key insight is that defenders rarely need more tools than they already have. More often, they need a clearer  understanding of how those tools work, where the vulnerabilities lie, and which everyday habits can expose them to risks.

The workshop therefore began with the fundamentals of digital security: how information travels online, where vulnerabilities emerge, how accounts are compromised, and why stronger authentication practices matter. Participants explored common attack pathways and practical measures for reducing exposure in their day-to-day work. The tools and exercises were selected for compatibility with the devices and operating systems that participants already relied on.

Foundations of digital safety

Participants installed secure communication tools like Tor and Orbot on their devices, worked through phishing recognition exercises based on scenarios familiar to the cohort, and tested safer-browsing configurations. The goal was not to introduce defenders to a long list of tools but to build working familiarity with a few, including practices of opening, inspecting, and configuring in ways they could transfer the acquired skills and knowledge onto their communities’ and colleagues’ devices.

Building on these foundations, the workshop moved onto OSINT and verification techniques that help defenders assess contested information and strengthen the credibility of human rights documentation. Participants practised reverse image searching against cases of recycled imagery presented as fresh evidence; used ExifTool to extract and read image metadata; and verified short-form video using the InVID-WeVerify verification plugin, parsing keyframes and tracing material across platforms.

Secure OSINT Documentation

Effective documentation and digital security are increasingly interconnected skills. The session on secure documentation walked participants through eyeWitness to Atrocities, the camera application developed by the International Bar Association that embeds metadata to support evidentiary chain of custody. In 2018, footage captured with eyeWitness was admitted as evidence before a military tribunal in Bukavu town, which subsequently convicted two armed group commanders of murder and torture, constituting crimes against humanity. It was the first time eyeWitness footage had been used in court proceedings in the DRC. The session also demonstrated structured data collection and management using Uwazi and  KoBoToolbox, both open-source platforms widely adopted for field research and human rights documentation.

These tools strengthened participants’ capacity to document and verify human rights abuses while also helping them to understand how their digital footprints can be exploited by adversaries. They also helped participants assess potentially misleading or manipulated content without inadvertently amplifying false information.

Outcomes

The training was grounded in the recognition that participants understand their own operating environments better than external facilitators ever can. The sessions were designed to strengthen existing knowledge and support locally informed security practices.

According to pre- and post-workshop evaluations, participant capacity increased from a composite score of 2.27 to 3.69 on a five-point scale. The results reflected a shift from limited familiarity with core concepts to practical competence in applying digital security and verification tools within their own documentation and advocacy work.

To extend the impact of the workshop beyond the participants in the room, CIPESA adopted a Training of Trainers (ToT) approach. Participants were encouraged to cascade the knowledge, tools, and practices acquired during the training within their organisations and communities. The approach supports the development of locally embedded digital security capacity and reduces reliance on external technical support.

Beyond the training

CIPESA’s work with refugee and exiled defender communities will continue, in collaboration with OMCT and other partners with adjacent mandates. The next phase will build on this foundation through sequenced follow-up modules, applied casework on documented matters, and ongoing technical support for the organisations represented in the cohort.

The aim is not simply to transfer skills during a workshop, but to strengthen the long-term resilience of organisations and networks engaged in human rights documentation, advocacy, and accountability work in increasingly complex digital environments.

11Jun

Protecting Children Online in Africa Must Move from Policy to Practice

Author CIPESA Posted on

By Patricia Ainembabazi |

Child online safety has returned to the forefront of digital governance discussions across Africa and globally. New regulatory initiatives from the United Nations, the African Union, and industry coalitions reflect growing concern about the risks children face in increasingly digital societies. Yet, while policy commitments are multiplying, implementation continues to lag.

The challenge is particularly acute in Africa, where internet access is expanding rapidly while child protection systems struggle to keep pace. As more children go online, they are increasingly exposed to cyberbullying, online grooming, sexual exploitation, harmful content, privacy violations, and emerging Artificial Intelligence (AI)-enabled risks such as disinformation and misinformation.

Just last month, the United Nations Human Rights Office called for stronger regulation and government oversight, publishing 10 key points to make platforms safer for children, urging technology companies to embed child safety into their product design and address the growing risk posed by AI. This reflects a broader shift in global digital policy. The Global Digital Compact has committed states to strengthen legal and policy frameworks for children’s rights in digital spaces and to prioritise national online child safety policies and standards by 2030.

At the continental level, the African Union Child Online Safety and Empowerment Policy of 2024 sets out principles on children’s safety and privacy, and participation to guide member states in developing national strategies, while the Global System for Mobile Communications Association (GSMA), UNICEF, and partners recently launched the Africa Taskforce on Child Online Protection to strengthen coordination among governments, mobile operators, technology companies, regulators, law enforcement, civil society, and young people.

Some African countries are already taking steps to strengthen child protection online. Rwanda is considering restrictions on social media access for children under 16, while Zimbabwe recently approved a National Child Online Protection Policy for 2026–2030 aimed at addressing online sexual exploitation, cyberbullying, grooming, harmful content, sextortion, and privacy violations.

These developments reflect a broader global shift in approaches to child online safety. Australia has legislated to restrict social media access for children under 16, while the United Kingdom recently concluded a national consultation examining age-based protections and enforcement mechanisms. Across several countries, governments, regulators, and civil society organisations are increasingly calling on technology companies to strengthen safeguards and take greater responsibility for protecting children online.

A broader strategy would expand efforts to ensure that while policies and frameworks on child protection are being developed, children are involved. This would help them understand the several platforms available for use, associated risks, pressures, and opportunities for digital life. The Africa Taskforce on Child Online Protection recognises this mode of participation and has now included youth representatives by integrating their voices for a child-centered digital future in Africa. Replicating this approach at the national level, through wide youth consultations, school-based dialogues, child-friendly policy forums, and participatory design of reporting and safety tools, will foster a healthy digital environment for the young.

It is against this backdrop that the Digital Rights Alliance Africa (DRAA) report, “Child Protection and Safety Online in Africa: The Law, Privacy, Challenges and Solutions, provides crucial, ground-level evidence across 10 countries – Algeria, Botswana, Egypt, Ghana, Kenya, Nigeria, Rwanda, South Africa, Tanzania, and Uganda. It highlights the gaps in child safety and protection online despite technological advancement and expansion.

The report highlights several recommendations that could help foster child safety and protection online, which are directed to different stakeholders, including the government, civil society organisations, international organisations, development partners, the technology sector, media, academia, parents, and the general community, and among others include;

  1. Parliaments should enact specific national laws that protect children’s privacy and safety in digital spaces, with clear safeguards tailored to children’s particular vulnerabilities, such as cyberbullying, grooming, online sexual exploitation, image-based abuse, harmful content, misuse of children’s data, profiling, and age-inappropriate design.
  2. Governments should invest in the implementation of national strategies that set out the roles of government agencies, the judiciary, data protection authorities, law enforcement actors, educators, parents, and the private sector in protecting children in the digital age.
  3. Platforms and telecom companies should design child-friendly products and services, minimise the collection and retention of children’s data, introduce age verification and parental controls, publish transparency reports, and submit protection measures to independent audits.
  4. The media should monitor, document, and report objectively, and expose all cases of online child abuse and demand accountability from the responsible parties.
  5. Civil society organisations should engage in advocacy, awareness raising, legal reform, evidence-based research, and documentation of issues affecting child safety online in order to demand and push for accountability of all the relevant stakeholders.
  6. All stakeholders must ensure that children are meaningfully included in innovation and programming, and that children and young people are actively engaged as participants in discussions, collaborations, and co-design of digital solutions.

Ultimately, for children to stay online, measures must go beyond mere policy expressions and aspirations as reiterated in the Global Digital Compact’s 2030. Laws and frameworks specific to child protection and safety online should be developed and stringently implemented. Moreover, digital service providers must be held accountable, and other stakeholders, including parents, schools, and communities, should join efforts to ensure that children are empowered to safely utilise digital technologies.

CIPESA and partners continue to advocate for rights-respecting policies that advance children’s protection, participation, access, and safe use of digital technologies, while calling on technology companies to embed these principles in platform design, governance, and accountability systems.

10Jun

Overview of CIPESA Policy Submissions to International Bodies and Governments

Author CIPESA Posted on

By CIPESA Writer |

Africa’s digital rights landscape is evolving rapidly, shaped by new legislation, emerging technologies, and recurring threats to civic space. CIPESA has remained actively engaged in documenting these developments, including through the annual State of Internet Freedom in Africa reports and through broader programming.

Over the last few months, we have made submissions to various international bodies and national governments, filed legal interventions, and provided expert commentary to advance internet freedom, digital inclusion, and democratic governance.

Below is an overview of our key submissions and commentaries in recent months.

Engaging Global Bodies on Technology Governance

Submission on How the WHO Digital Health Strategy Should Govern Data, Artificial Intelligence (AI) and Digital Public Infrastructure (DPI): In March 2026, CIPESA submitted recommendations to the World Health Organization (WHO) Regional Office for Africa on the development of the Global Digital Health Strategy for 2028–2033, urging that the strategy be anchored on human rights, equity, and accountability. CIPESA warned that most AI systems used in African healthcare are trained on non-African datasets, increasing risks of inaccurate diagnoses and exclusions, and called for mandatory “explainability” standards, equity impact assessments, and domestic investment in digital health infrastructure.

Recommendations to the OHCHR: Also in March, CIPESA submitted to the UN Human Rights Council under Resolution 58/23 on the risks digital technologies pose to human rights defenders in Africa. The submission examined legal and policy developments, tech-facilitated attacks including against women HRDs, AI-related risks, and challenges facing civil society and companies, while recommending stronger corporate measures to identify, assess, and prevent harm to HRDs. CIPESA submitted comments and recommendations on due diligence and improved responses to digital technology-related risks faced by human rights defenders.

Engaging National Governments on Digital Legislation Commentary on Zimbabwe National AI Strategy: The Southern African state recently adopted its National AI Strategy 2026–2030 (AI strategy)  to guide its digital technology and transformation. The strategy aims to accelerate development, enhance industrialisation, and improve service delivery in sectors such as health, finance, agriculture, education and public administration. The strategy also emphasises building local data infrastructure as opposed to relying on foreign data storage infrastructure while promoting an AI governance approach grounded in Ubuntu, human rights, accountability, transparency and inclusivity. However, an important question is whether Zimbabwe’s approach offers useful lessons for other African countries developing national AI strategies. Find our commentary here.

Submission on the Uganda AI and Emerging Technologies Strategy: In March 2026, CIPESA submitted recommendations to Uganda’s National AI and Emerging Technologies Strategy Taskforce, welcoming the country’s ambition to harness AI for development while cautioning that innovation must be matched with legal, institutional, and ethical safeguards. Find a commentary here.

CIPESA called for a rights-by-design approach including mandatory Human Rights Impact Assessments for high-risk AI systems, algorithmic transparency, local data representation, and meaningful civil society participation in shaping Uganda’s AI strategy.

Outpaced by Its Own Ambition: Can Kenya Bridge Its AI Regulation Gap? This commentary highlighted the raw paradox at the heart of Kenya’s AI, noting that the country is simultaneously sprinting ahead in AI adoption while grappling with a shrinking space for the very digital voices that AI empowers. A key remains between ambition and readiness as the country ranks 93rd in the 2025 Government AI Readiness Index, due to persistent weaknesses in infrastructure, implementation, and institutional capacity. Find a commentary here.

Submission to the White Paper on ICT Tax Reduction in Uganda: A year ago, CIPESA submitted a position paper to the National Task Team on Enhancement of Government Revenue from the ICT Sector at the Uganda Ministry of ICT and National Guidance. The paper benchmarked Uganda’s ICT sector tax policies, licensing fees, and regulatory regimes against those of Kenya, Rwanda, and Tanzania. Since then various developments have emerged which inform the ICT tax regime in Uganda including the April 2026 passing of the Value Added Tax (Amendment) Bill, 2026, which rejected the controversial government proposal to impose an 18 percent tax on imported software after lawmakers warned it would undermine the country’s digital transformation agenda.

Engaging the African Commission on Human and Peoples’ Rights (ACHPR)

ACHPR Resolution 630 on Monitoring Technology Companies: In March 2025, the ACHPR adopted Resolution 630, a timely step toward holding technology companies accountable for information integrity in Africa. CIPESA welcomed the move, contributed recommendations across key regional forums, and looks forward to strengthening the newly developed guidelines through the review process.

Prioritising Human Rights Defenders: CIPESA reviewed the Draft Declaration on the Promotion and Protection of Human Rights Defenders in Africa, which seeks to help restore civic space for the effective protection of human rights. In its submission to the Special Rapporteur on Human Rights Defenders and Focal Point on Reprisals in Africa, CIPESA highlighted the draft’s strengths, weaknesses, and gaps, and offered practical recommendations to align it with continental and global standards, particularly the 1998 UN Declaration on Human Rights Defenders. Find the submission here

Supporting the Ratification of the AU Disability Protocol: CIPESA has consistently called upon African Union member states to ratify the Protocol to the African Charter on Human and Peoples’ Rights on the Rights of Persons with Disabilities in Africa. Our submission to the ACHPR Working Group on the Rights of Older Persons and People with Disabilities in Africa (April 2022) argued that ratification is a matter of utmost priority and that without it, the digital rights of persons with disabilities across the continent remain inadequately protected.

Contributing to the Universal Periodic Review (UPR)

Joint Stakeholder Submission on Tanzania’s Digital Rights Record: Ahead of Tanzania’s fourth cycle UPR before the UN Human Rights Council set to take place in November 2026, CIPESA, alongside the Pan African Lawyers Union (PALU) and JamiiAfrica, submitted a joint stakeholder report documenting the state of digital rights in the country.

While acknowledging positive developments including the enactment of the Personal Data Protection Act, 2022, and reforms to the Media Services Act, the submission highlighted persistent concerns: the use of vague laws to suppress online expression, the blocking of platforms including Clubhouse, X, and JamiiForums, a nationwide internet shutdown during the 2025 general elections, and the escalating threat of Technology-Facilitated Gender-Based Violence (TFGBV) against women journalists and activists.

The submission called on Tanzania to repeal or amend vague and overly broad laws, comply with international human rights standards on internet access, establish judicial oversight over surveillance, and invest in digital rights literacy.

Rwanda’s fourth cycle UPR review: Rwanda had its UPR review in January 2026 where following the November 2025 pre-session in Geneva, several permanent missions expressed eagerness to advance strong recommendations for Rwanda, and CIPESA’s evidence and recommendations were expected to inform their engagement during the formal review.

A joint submission by CIPESA and the Association for Progressive Communications (APC) noted that digital technologies have expanded the avenues through which women are targeted, often enabling harm that is faster, more pervasive, and harder to remedy.

Rwanda’s UPR presented a timely opportunity to adopt meaningful, future-focused reforms that uphold human rights, ensure accountability, and create a digital environment where all citizens, especially women, can participate safely, freely, and equally.

Since the review, the Rwandan government has noted they would undertake national consultations with relevant stakeholders to assess the recommendations and determine its position.

Liberia’s fourth cycle UPR review: CIPESA, in collaboration with the West Africa ICT Action Network (WAICTANET), submitted a joint stakeholder submission for Liberia’s consideration during the 50th session of the UPR. The joint submission observed that, although Liberia has taken preliminary steps towards aligning its domestic legal and policy framework with applicable regional and international human rights standards, substantial legal, institutional, and enforcement gaps persist. It called for the Government to adopt comprehensive data protection and cybersecurity legislation; safeguard the right to freedom of expression online; ensure accountability for violations against journalists, human rights defenders, and online actors; strengthen transparency and effective access to information; and implement targeted measures to bridge the digital divide.

Malawi’s fourth cycle UPR review: A joint submission was made by CIPESA alongside the The Centre for Human Rights and Rehabilitation (CHRR), the International Press Institute (IPI), the University of Birmingham, and Small Media, on digital rights in Malawi. The submission recommended law reform, full implementation of the Access to Information Act, affordable and inclusive internet access, independent oversight for digital rights violations, operationalisation of the Data Protection Act, protection of encryption, and safeguards against unlawful spyware use.

Looking Ahead

Across these engagements with the ACHPR, the Universal Periodic Review of the UN Human Rights Council, the WHO, and national governments in Uganda, Kenya, Tanzania, and Zambia, CIPESA’s work reflects a consistent commitment to promoting inclusive and effective use of ICT in Africa for improved governance and livelihoods.As the digital governance landscape continues to shift, our submissions serve as a continued resource for policymakers, civil society, the media and other entities committed to advancing internet freedom in Africa.

1 2 3 … 20