1. Introduction

The Uganda Revenue Authority (“URA”, “we”, “us” or “our”) is a statutory body established under the Uganda Revenue Authority Act (Cap. 196), mandated to assess, collect and account for central Government Tax Revenue and provide related services to taxpayers and the public.

In delivering these services, URA operates mobile applications, including AskURA (package name: ug.app.mob.askura), and may operate other mobile applications from time to time. This Privacy Statement explains how URA collects, uses, discloses, stores, retains and protects personal data when you download, install, access or use any URA mobile application (each “an App” and together “the Apps”).

The Statement also explains your rights in relation to your personal data and how you may exercise them. URA is committed to handling personal data lawfully, fairly, transparently, securely and with the participation of the data subject, in accordance with the Constitution of the Republic of Uganda, the Data Protection and Privacy Act, Cap. 97, the Uganda Revenue Authority Act Cap. 196, Tax Procedures Code Act, Cap. 343, the Data Protection and Privacy Regulations, 2021.

By using the Apps, you acknowledge that you have read and understood this Statement. Where the law requires consent for processing or collecting data, URA will request for that consent separately and in a clear manner.

2. Data Controller

For the purposes of this Statement, URA is the data controller in relation to personal data processed through the Apps, except where expressly stated otherwise. URA determines the purposes and means of collecting and processing personal data through the Apps.

3. Definitions

In this Statement, the following terms have the meanings assigned to them under the Data Protection and Privacy Act, Cap. 97:

• Personal data: means information about a person from which the person can be identified, that is recorded in any form and includes data that relates to; the nationality, age or marital status of the person; the educational level, or occupation of the person; the identification number, symbol or other identity data; or other information which is in the possession of, or is likely to come into the possession of URA.
• Special or sensitive personal data: personal data of a sensitive nature, including financial particulars. URA treats Taxpayer Identification Numbers (TINs), taxpayer account details and tax-related particulars with heightened care.
• Data subject: means an individual from whom or in respect of whom personal information has been requested, collected, collated, processed or stored, for example a user of the Apps.
• Processing: means any operation which is performed upon collected data by automated means or otherwise including; organisation, adaptation or alteration of the information or data; retrieval, consultation or use of the information or data; disclosure of the information or data by transmission, dissemination or otherwise making available with the consent of the data subject or alignment, combination, blocking, erasure or destruction of the information or data.
• Data controller: means a person who alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed.
• Data collector: means a person who collects personal data.
• Data processor: means a person who alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed.
• Consent: means any freely given, specific, informed and unambiguous indication of the data subject’s wish which he or she, by a statement or by a clear action, signifies agreement to the collection or processing of personal data relating to him or her.
• PDPO: the Personal Data Protection Office of Uganda.
• Data protection officer: means a designated person by the Commissioner General of URA as the data protection officer responsible for ensuring compliance with data protection and privacy laws.

4. Scope of this Statement

This Statement applies only to personal data collected through URA mobile applications. It does not apply to:

• URA web platforms and portals, including eTax and other web-based services, which may be governed by separate privacy notices.
• information collected through other channels such as URA Service Centres, Contact Centres, email, telephone, correspondence or field operations; or
• third-party websites, services or applications that may be linked from within the Apps and that are operated by parties other than URA.

5. Legal and Regulatory Framework

URA processes personal data in accordance with the laws of Uganda, including in particular:

• Article 27 of the Constitution of the Republic of Uganda, 1995, which protects the right to privacy of the person, home, correspondence and communication.
• the Data Protection and Privacy Act, Cap. 97 and the Data Protection and Privacy Regulations, 2021.
• the Uganda Revenue Authority Act Cap. 196.
• the Tax Procedures Code Act, Cap. 343, including confidentiality and secrecy obligations relating to taxpayer information; and
• other applicable laws and regulations relating to data protection, information security, public administration and the administration of tax.

URA is registered with the Personal Data Protection Office of Uganda and observes the data protection principles under the Data Protection and Privacy Act, Cap. 97. These among others include lawful, fair, transparent, purpose and retention limitations, minimization, accuracy, and secure processing, collection and control of personal data.

6. Personal Data We Collect

URA limits the personal data collected through the Apps to what is necessary for the purposes described in this Statement. Depending on the App and the features used, URA may collect the categories of data set out below.

6.1 Information you provide to URA

• Identity and account data: such as your name, TIN, email address, telephone number, taxpayer account details and other information required to register, log in, verify your identity or link a taxpayer account.
• Content you submit: such as enquiries, requests, feedback, complaints, service requests and information entered when using App features.
• Images, documents and files: where a feature requires it, the App may allow you to use your device’s camera or select files or photographs from your device to capture or upload documents, such as supporting documents for a request. These are accessed only when you actively choose to use such a feature.

6.2 Information collected automatically

• Device and technical data: such as device model, operating system and version, App version, language settings, network information, Internet Protocol (IP) address and technical device identifiers required for security, diagnostics and service delivery.
• Diagnostic and usage data: such as App performance data, error reports, crash information, security logs and basic usage logs that help URA maintain, secure and improve the Apps.

6.3 Use of the Apps without logging in

Access to general App features does not require login. Some features, particularly those relating to a taxpayer account, require you to log in or otherwise verify your identity before the feature can be provided.

6.4 Data URA does not collect

• Location data: URA Apps collect precise or approximate geographic location information only when you use the service centre location guidance feature. The purpose of this feature is clearly disclosed within the app, and location information is accessed only after you grant the required consent. URA Apps do not collect or use your location information for any other purpose other than that which is specified herein.
• Third-party advertising and tracking: URA Apps do not use third-party advertising networks, do not sell personal data and do not use personal data for third-party advertising.
• Third-party analytics: URA Apps may use third-party analytics and crash-reporting services to monitor application performance, diagnose technical issues, and improve the quality and reliability of the apps. Where such services are used, URA does not intentionally disclose personally identifiable information to the service providers. Where possible, analytics and diagnostic information is aggregated, anonymized, or pseudonymized before being shared.

If a future version of an App introduces additional data collection or integrates third-party services, URA will update this Statement or provide an App-specific notice and, where required by law, request your consent before such collection or processing takes place.

7. How URA Uses Personal Data

URA uses personal data for the purposes and lawful bases set out below.

URA will not use personal data collected through the Apps for purposes that are incompatible with those described above without first informing you and, where required by law, obtaining your consent.

8. Automated Decision-Making and Profiling

URA does not use personal data collected through the Apps to carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. If this position changes, URA will update this Statement or provide an App-specific notice and, where required obtain your consent before doing so.

9. App Permissions

To deliver specific features, an App may request permissions on your device. You control these permissions and may grant or revoke them through your device settings. The main permissions URA Apps may request are:

• Camera: to capture documents or images where a feature requires it.
• Photos, files or storage: to allow you to select and upload documents or images from your device.
• Internet or network access: to connect securely to URA services and transmit your requests.
• Notifications: to send App-related alerts, confirmations or service updates where the App supports notifications and you allow them.

Permissions are used only for the purposes described and only where the relevant feature requires them. If you decline or revoke a permission, the affected feature may not function, but you may continue to use other parts of the App.

10. How URA Shares Personal Data

URA treats personal data, including taxpayer information, as confidential. URA does not sell personal data. URA may share personal data only in limited circumstances, including:

• Within URA: with authorised officers, units and departments that need the data to perform their duties.
• With service providers or data processors: where they process data on behalf of URA under written contracts requiring confidentiality, security and processing only on URA’s documented instructions.
• With other government bodies and competent authorities: where required or permitted by law for the lawful administration of tax, public administration, audit, investigation or regulatory purposes.
• For legal reasons: where disclosure is necessary to comply with a legal obligation, court order, lawful request from a competent authority, or to protect the rights, safety and security of URA, users or the public.

Any sharing of taxpayer information is subject to confidentiality and secrecy obligations under the Tax Procedures Code Act, 2014, the Data Protection and Privacy Act, 2019 and other applicable laws.

11. Data Storage, Security and Retention

URA implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss, destruction or misuse. These measures include access controls, role-based access restrictions, secure authentication controls, encryption of data in transit, secure infrastructure, logging and monitoring, vulnerability management and staff confidentiality obligations.

Personal data collected through the Apps is stored on secure servers managed by URA or by service providers acting on behalf of URA. The use of non-resident cloud infrastructure for the storage and/or processing of such data is not permitted by Government policy.

URA retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, tax-administration, accounting, audit, reporting, dispute-resolution and records-management requirements. Taxpayer-related records are retained in accordance with applicable tax laws and URA-approved records-retention schedules. Account, diagnostic and usage data are retained only for as long as necessary for the purposes described in this Statement, unless a longer retention period is required or permitted by law.

When personal data is no longer required, URA securely deletes, anonymises or archives it in accordance with applicable law and URA records-management requirements.

12. Data Breach Notification

URA maintains procedures to detect, report, assess and investigate personal data breaches. In the event of a breach affecting personal data, URA will take prompt steps to contain and assess the breach, mitigate potential harm and take corrective action.

Where required by the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021, URA will notify the Personal Data Protection Office. Where a breach is likely to result in significant harm to affected individuals, URA will also notify affected individuals within the timelines required by law, describing the nature of the breach and the measures taken or proposed to address it.

13. Cross-Border Transfers

Personal data collected through the Apps is primarily stored and processed within Uganda. Where it is necessary to transfer, store or process personal data outside Uganda, including through cloud infrastructure or external service providers, URA will ensure that the transfer complies with the Data Protection and Privacy Act, Cap. 97 and the Data Protection and Privacy Regulations, 2021.

URA will use appropriate safeguards for cross-border transfers, which may include contractual protections, security controls, transfer to jurisdictions or recipients with adequate safeguards, and any other measures required or permitted by applicable law. Where consent is required for a specific transfer, URA will request it in a clear manner.

14. Children’s Privacy

The Apps are intended for use by taxpayers and the general public and are not directed at children. URA does not knowingly collect personal data from children through the Apps except where a parent, guardian or other person lawfully acts on behalf of a child or another individual in relation to tax matters. If you believe that a child has provided personal data through an App without appropriate authority, please contact URA so that appropriate action may be taken.

15. Rights of a Data Subject

Subject to the Data Protection and Privacy Act, 2019 and other applicable laws, you have the following rights in relation to your personal data:

• Right to be informed: to know how your personal data is collected and used.
• Right of access: to request access to personal data URA holds about you.
• Right to correction: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of personal data where there is no lawful basis for URA to continue holding it.
• Right to object or restrict processing: to object to, or request restriction of, certain processing activities.
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting prior lawful processing.
• Right to complain: to lodge a complaint with the Personal Data Protection Office.
• Right in relation to automated decision-taking: decisions taken by or on behalf of the data controller which significantly affect the data subject based on data collected and processed by automatic means.

Some rights may be limited where URA is required by law to retain or process personal data, including for tax-administration, legal, audit, investigation, reporting or records-management purposes. To exercise your rights, please contact URA using the details in Section 18.

This Statement does not affect any statutory obligations requiring URA to retain taxpayer information in accordance with applicable laws.

16. Taxpayer Accounts and Personal Data

URA Apps do not provide facilities for creating or deleting taxpayer accounts. Where authentication is required, users sign in using their existing taxpayer credentials (Tax Identification Number (TIN) and taxpayer portal password). The management, suspension or closure of taxpayer accounts is governed by applicable tax laws, regulations and URA administrative procedures and cannot be performed through the Apps.

If you wish to exercise your rights in relation to your personal data, including requesting access to, correction of, or deletion of personal data where permitted by applicable law, you may submit a request using the contact details provided in Section 18.

Upon receiving and verifying such a request, URA will process it in accordance with applicable data protection and tax laws. Personal data will only be deleted, anonymized or otherwise disposed of where such action is lawful and where the data is no longer required for tax administration, legal, audit, investigation, reporting, records management or any other statutory purpose. Where URA is required or permitted by law to retain personal data, it will continue to do so for the applicable retention period.

17. Changes to this Privacy Statement

URA may update this Privacy Statement from time to time to reflect changes in App features, technology, legal requirements or data-processing practices. When material changes are made, URA will revise the effective date above and, where appropriate, notify users through the relevant App or other suitable means. Users are encouraged to review this Statement periodically.

18. Contact URA

If you have questions, concerns or requests regarding this Privacy Statement or your personal data, please contact:

• Data Protection Office, Uganda Revenue Authority.
• Postal address: P.O. Box 7279, Kampala, Uganda.
• Physical address: Plot M193/M194, Nakawa Industrial Area, Kampala, Uganda.
• Email:
• Toll-free: 0800117000 / 0800217000.
• Website: www.ura.go.ug.

You also have the right to lodge a complaint with the regulator:

• Personal Data Protection Office (PDPO).
• Website: www.pdpo.go.ug.

How do you find this resource?

Share

Share now