Access is logged and processing follows the Uganda Data Protection and Privacy Act (DPPA). Personal data (National ID, contact, and bank details) is processed only to verify beneficiaries and distribute entitled payments, held under role-based access, and recorded in a tamper-evident audit trail. This is a prototype: all beneficiary records shown are synthetic.