An evaluation of the ethical- regulatory practices for genomic data sharing at three research-intense institutions in Uganda

Abstract Background Despite the implementation of data protection regulations in several African countries, limited attention has been given to the governance of genomic data. This study used an evaluative research design to assess the ethical and regulatory practices for genomic data sharing at three research-intensive institutions in Uganda, with the aim of understanding capacity needs and identifying measures to strengthen responsible genomic data governance at the institutional level. Methods Three institutions were purposively selected and anonymized as A, B, and C. A document review of eight genomic data sharing agreements (DSAs) was conducted, and key informant interviews with researchers, national research regulators, and lawyers were used as a form of validation. DSAs were requested because they are a requirement by the Uganda National Council for Science and Technology in collaborative research. A checklist was developed guided by the Malabo Convention and the Uganda Data Protection and Privacy Act. Data were analyzed using both deductive and inductive approaches. Five predefined domains guided the assessment: data ownership, protection and security, access, intellectual property, and benefit sharing. Emerging themes included informed consent, legal enforceability, and potential community harms. Results The three institutions had DSAs; however, legal enforceability remains challenging. With the exception of one template, all agreements were signed and specific to genomic studies. Most DSAs stated that data ownership remained with the provider. Some of the agreements mentioned data protection, a few addressed intellectual property rights. None of the agreements included benefit-sharing statements, and the key informants confirmed the absence of a benefit-sharing framework. One institution had a legal office directly involved in research contracts, and some had functioning research ethics committees. Consent processes were largely regarded as procedural rather than meaningful, and concerns were raised about potential social harms. Conclusion While all institutions had some basic guidance on data sharing, significant gaps remained, particularly in relation to benefit sharing, data protection, and legal oversight. The absence of statements on benefit sharing could be a fertile ground for exploitation. Institutions should strengthen consent processes and adopt participatory policy development approaches informed by frameworks like H3Africa. Legal and ethical support structures are also essential to safeguard the interests of emerging researchers.