The Uganda Revenue Authority (URA) has launched an assertive drive to recover unpaid taxes, issuing more than 1,000 compliance notices since June 2026 and sending information requests to commercial banks, documents seen by The East African show.
Scope of the campaign
The letters, many of which demand unpaid taxes, have targeted a range of entities. One demand cited a URA review of tax returns filed between June 2024 and June 2025 for a local pharmaceutical distributor and included a fresh tax demand for Value Added Tax (VAT) worth billions of shillings. Another URA letter, dated 27 July 2026, asked Standard Chartered Bank Uganda for bank statements and director identity records linked to a local steel company being audited over a five-year period from December 2020 to December 2025.
Data requests versus privacy law
The URA's statutory power to request information is grounded in the Tax Procedures Code Act, but the Data Privacy and Protection Act of 2019 creates constraints for regulated entities holding personal data. Under the privacy law, sharing personal information with third parties generally requires the data subject's consent unless a court order is obtained.
That legal tension is at the heart of the current push: while the tax authority seeks comprehensive records from banks, insurance companies, telecoms and audit firms, those institutions face obligations to protect client data and to comply with privacy rules.
Business and economic implications
The wave of demand notices and information requests has raised concern about several effects on the private sector and economy:
- Liquidity pressure on businesses: Fresh tax bills, including large VAT demands, can strain working capital for companies already operating in tight margins.
- Operational burden for banks and regulated firms: Institutions asked to produce records must balance compliance with tax investigations against privacy duties and potential legal exposure.
- Market confidence and investor perception: A visible, broad-based enforcement campaign can signal stronger revenue collection but may also be read as an indicator of stress in public finances or higher revenue targets.
- Legal and procedural friction: Where consent is absent and courts are not engaged, the need for judicial orders could slow enquiries and complicate collections.
External factors and unanswered questions
The East African report links the intensified URA activity to higher revenue targets and notes the broader international context, including possible spillovers from the US–Iran military conflict. The latter was cited as part of the rationale for concern about economic fallout, though the report does not quantify the mechanism.
URA officials were unavailable for comment at the time The East African's reporting was published. The documents reviewed by the newspaper provide specific examples of demands and requests but do not disclose the overall sums the URA expects to recover from the campaign.
What this means for businesses and banks
For firms operating in Uganda, the immediate priorities are clear: ensure tax filings are complete and defensible, preserve documentary evidence supporting declared losses or theft claims (as in the pharmaceutical distributor example), and be prepared for requests that may cover multi-year periods.
Banks and other custodians of personal data must navigate a delicate compliance path — responding to lawful tax enquiries while observing privacy protections. Where consent is not available, institutions may need to seek legal clarity or insist on court orders before surrendering personal information.
For regional observers and investors, the episode is a reminder that revenue authorities are likely to escalate enforcement when fiscal targets tighten. That can improve tax collection in the near term, but it also raises short-term risks for corporate cash flow and could provoke legal disputes over data access.
"These letters include demands for unpaid taxes and requests for taxpayer information from banks," The East African reported.
As the URA pursues the notices and banks evaluate their legal duties, the balance between robust tax enforcement and data-privacy safeguards will determine how quickly the campaign translates into recovered revenue — and how much it costs businesses in time, legal fees and working capital strain.
