NGOs in Uganda: protecting beneficiary data from AI tools

In a field office in Arua or Kyangwali, a protection officer has to finish her weekly report before the evening. She pastes her interview notes into ChatGPT to get a clean summary. Those notes contain names, registration numbers, a location inside the settlement and the account of an assault. The summary comes back in ten seconds. The data has already left for a server abroad.

Nothing about this scene is unusual. NGOs and humanitarian agencies in Uganda work under pressure with small teams, and generative AI genuinely helps them. But they also hold some of the most sensitive data there is: information about people who fled their country. Ugandan law applies to that data, and the PDPO has already reminded NGOs that they are not exempt.

Uganda, Africa's largest refugee host

According to UNHCR, Uganda was hosting about 1.93 million refugees in mid-2025, more than any other African country. More than a million of them are under 18. Most new arrivals come from South Sudan, the Democratic Republic of the Congo and Sudan.

A dense ecosystem has grown around this population: UN agencies, large international NGOs, local associations, implementing partners and cash transfer providers. Each of them collects, shares and analyses beneficiary data, often in spreadsheets that pass from hand to hand.

NGOs are not exempt from the 2019 Act

The Data Protection and Privacy Act 2019 applies to any organisation that collects or processes personal data in Uganda. Being a charity or a humanitarian body changes nothing. In October 2022, the National Bureau for Non-Governmental Organisations issued a circular asking NGOs to register with the Personal Data Protection Office, the PDPO, which sits within NITA-U.

The registration file asks in particular for:

• the nature and categories of personal data processed;

• the contact details of the data protection officer;

• any transfers of data outside Uganda;

• the security measures in place.

The last two points are directly about AI. A consumer assistant hosted outside the country is a transfer. And an organisation that does not know what its staff send to these tools will struggle to describe its security measures. We covered the general framework, registration and penalties in our PDPO compliance guide.

Beneficiary data is especially exposed

In humanitarian work, a leak is not measured only in fines. A list of beneficiaries with their origin, ethnicity or presumed political affiliation can put lives at risk, in Uganda and in the country of origin. The 2019 Act treats political opinions, religious beliefs, health and sex life as special personal data.

The same risky situations keep coming up:

• case management notes on gender-based violence, rewritten by a chatbot;

• distribution or cash transfer lists with phone numbers and amounts, analysed in an AI assistant;

• health data from mobile clinics, summarised for a donor report;

• funding proposals drafted from real case studies, with names still in them.

Why AI spread through NGOs without rules

Humanitarian budgets were cut hard in 2025, and UNHCR warned of reduced services in Uganda. Fewer staff, more reports to produce, demanding donors: free AI becomes a reflex. It rarely arrives through a management decision. It arrives when one colleague shows the tool to another.

The outcome is invisible use, known as Shadow AI. Its real costs are set out in the real cost of Shadow AI in 2026. In an NGO, staff turnover, volunteers and shared laptops make the risk worse.

Training your teams is not enough

Most humanitarian organisations already run data protection and "do no harm" training. The ICRC Handbook on Data Protection in Humanitarian Action is a reference across the sector. These materials remain essential, but nobody opens them at the moment a tired employee pastes a table into a chatbot at 10 pm. We explain why in why AI security training doesn't work.

What works better

1. Approve specific tools instead of banning everything, so people do not look for workarounds.

2. Define the data that must never be sent: registration numbers, phone numbers, health data, case notes.

3. Replace that data automatically with fictitious values in the same format before sending, as described in our article on format preserving anonymization.

4. Keep a record of the incidents you prevented, useful for the PDPO and for donor audits.

How ZeusLock helps humanitarian organisations

ZeusLock runs on your teams' devices and browsers, at the Kampala head office as well as in field offices. Before a prompt or file reaches ChatGPT, Copilot, Gemini or Claude, it spots sensitive data: names, Ugandan phone numbers, NINs, beneficiary identifiers, health terms. Depending on your rules, it anonymises them, warns the user or blocks the request. Every event is logged, giving you concrete evidence to show the regulator or your donors.

Summary

NGOs in Uganda handle data about vulnerable people, at scale, with shrinking resources. The 2019 Act applies to them in full, including transfers abroad. AI can lighten their workload, as long as beneficiary data stays where it belongs.

Do you work for an NGO or humanitarian agency in Uganda? Book a ZeusLock demo and see how to protect your beneficiary data.