A complainant sought an order compelling NIRA to disclose National Identification Register data relating to ten third-party data subjects. The PDPO refused the principal relief as a matter of law: it cannot order a controller to disclose personal data absent a statutory basis, and doing so would direct NIRA officers into conduct criminalised by section 81 of the Registration of Persons Act. The Office pointed the complainant to the Registration of Persons access regulations, police or DPP formal requests, or court-supervised disclosure including Norwich Pharmacal orders. Decided 28 May 2026.
PDPO (Uganda), National Identification and Registration Authority (NIRA), determination of 28 May 2026. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/uganda/pdpo/2026/nira-register-access-refused/ (accessed 22 July 2026).