docs: update README, CHANGELOG, and regulatory tracking for v1.3.0

Adds Uganda DPPA 2019, Tanzania PDPA 2022, and Ethiopia PDP (draft) to
all documentation — coverage table, OPA Rego table, jurisdiction router
table, Quick Start examples, and roadmap. CHANGELOG entry for v1.3.0
(306 → 384 tests, 3 → 6 jurisdictions). REGULATORY-CHANGES.md updated
with initial implementation rows and three new "watch" entries including
Ethiopia PDPP critical-monitoring flag.

Author: kingztech2019

CHANGELOG.md

@@ -7,6 +7,25 @@ Versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [1.3.0] — 2026-06-18
+
+East Africa policy expansion — Uganda, Tanzania, and Ethiopia regulatory packs.
+
+### Added
+
+- **Uganda DPPA 2019** (`uganda-dppa.yaml` + `rego/uganda-dppa.rego`) — Uganda Data Protection and Privacy Act 2019. Covers: NIRA national ID (CM + 12-char) blocking, biometric deny, PDPO breach-suppression detection, financial data escalation, special category (health, ethnic origin, religion) escalation, cross-border transfer controls (s.13, s.19, s.22). Permitted regions: `af-south-1`, `af-east-1`, `uganda`, `UG`. 28 tests.
+- **Tanzania PDPA 2022** (`tanzania-pdpa.yaml` + `rego/tanzania-pdpa.rego`) — Tanzania Personal Data Protection Act 2022. Covers: NIDA national ID (20-digit format) blocking, biometric deny, PDPC breach-suppression detection, consent-enforcement deny, special category escalation, cross-border transfer controls (s.8, s.13, s.17, s.25). Permitted regions: `af-south-1`, `af-east-1`, `tanzania`, `TZ`. 28 tests.
+- **Ethiopia PDP** (`ethiopia-pdp.yaml` + `rego/ethiopia-pdp.rego`) — Ethiopia Computer Crime Proclamation No. 958/2016 + draft Personal Data Protection Proclamation. Covers: Fayda/MOSIP ID blocking, biometric deny, unauthorised-access detection (Proclamation 958/2016), ECA breach-suppression detection, special category escalation, cross-border transfer controls. Permitted regions: `af-south-1`, `af-east-1`, `ethiopia`, `ET`. Pack tagged `draft` — update when dedicated PDPP is enacted. 28 tests.
+- **Jurisdiction router updated** — `UG`, `TZ`, `ET` added to `jurisdiction_policies`. NG routes 9 packs; KE, ZA, UG, TZ, ET each route 6 (5 universal + 1 regulatory).
+- **README updated** — Coverage table, OPA Rego table, Jurisdiction Router table, Quick Start examples, and Roadmap all updated for the three new packs.
+
+### Changed
+
+- Total OPA tests: 306 → 384 (78 new tests across the three packs)
+- Jurisdiction count: 3 → 6 (NG, KE, ZA → NG, KE, ZA, UG, TZ, ET)
+
+---
+
 ## [1.2.0] — 2026-06-16
 
 Universal agent safety controls — 5 new policy packs applicable to any AI agent.

README.md

@@ -2,11 +2,11 @@
 
 [![Validate Policies](https://github.com/kingztech2019/agt-policies-nigeria/actions/workflows/validate.yml/badge.svg)](https://github.com/kingztech2019/agt-policies-nigeria/actions/workflows/validate.yml)
 
-**Nigerian & African AI Agent Governance Policies for Microsoft's [Agent Governance Toolkit (AGT)](https://github.com/microsoft/agent-governance-toolkit)**
+**Pan-African AI Agent Governance Policies for Microsoft's [Agent Governance Toolkit (AGT)](https://github.com/microsoft/agent-governance-toolkit)**
 
 A community policy pack that extends AGT with two governance layers:
 - **Universal agent safety controls** — prompt injection, PII leakage, tool permissions, human approval, model routing (apply to any AI agent regardless of jurisdiction)
-- **African regulatory compliance** — NDPA 2023, CBN regulations, NFIU/AML rules, BVN/NIN data protection, Kenya DPA, POPIA (jurisdiction-routed)
+- **African regulatory compliance** — NDPA 2023, CBN, NFIU/AML, BVN/NIN, Kenya DPA, POPIA, Uganda DPPA, Tanzania PDPA, Ethiopia PDP (jurisdiction-routed)
 
 Two policy formats:
 - **YAML** (`policies/*.yaml`) — drop-in rules files, validated by the AGT linter, no new infrastructure
@@ -49,6 +49,9 @@ Jurisdiction-routed: policies activate based on `customer_country` in context.
 | `nfiu-aml-str.yaml` | NFIU AML/CFT Regulations | STR/CTR triggers, structuring detection, velocity controls |
 | `popia-south-africa.yaml` | POPIA (South Africa) | Cross-border transfer controls, special personal information, SA ID masking |
 | `kenya-dpa.yaml` | Kenya Data Protection Act 2019 | Cross-border transfer restrictions, sensitive data, breach notification (72h to ODPC) |
+| `uganda-dppa.yaml` | Uganda Data Protection and Privacy Act 2019 | Cross-border transfers, biometric blocking, NIRA national ID protection, financial data, PDPO breach notification |
+| `tanzania-pdpa.yaml` | Tanzania Personal Data Protection Act 2022 | NIDA national ID (20-digit), special category data, PDPC breach notification, consent enforcement |
+| `ethiopia-pdp.yaml` | Ethiopia Proclamation 958/2016 + draft PDPP | Fayda/MOSIP ID protection, unauthorised access detection, ECA breach notification, cross-border controls |
 
 ### OPA Rego (structured-parameter enforcement)
 
@@ -65,6 +68,9 @@ Jurisdiction-routed: policies activate based on `customer_country` in context.
 | `nfiu-aml.rego` | `agt_policies_nigeria.nfiu` | Exact ₦5M CTR threshold on `input.params.amount`, structuring zone (₦4.5M–₦4.99M) |
 | `kdpa-data-protection.rego` | `agt_policies_africa.kdpa` | Cross-border transfers, sensitive data, biometric blocking, ODPC accountability |
 | `popia-south-africa.rego` | `agt_policies_africa.popia` | `destination_country` adequacy list (POPIA s.72), SA ID 13-digit format validation |
+| `uganda-dppa.rego` | `agt_policies_africa.uganda_dppa` | NIRA national ID blocking, biometric deny, PDPO breach suppression detection, financial data escalation |
+| `tanzania-pdpa.rego` | `agt_policies_africa.tanzania_pdpa` | NIDA 20-digit ID blocking, PDPC breach suppression detection, consent enforcement, biometric deny |
+| `ethiopia-pdp.rego` | `agt_policies_africa.ethiopia_pdp` | Fayda ID blocking, unauthorised access detection (Proclamation 958/2016), ECA breach suppression, biometric deny |
 
 ---
 
@@ -162,7 +168,6 @@ opa eval -d policies/rego/ndpa-data-residency.rego \
   -i examples/inputs/ndpa-allow-permitted.json \
   "data.agt_policies_nigeria.ndpa.decision"
 # → "allow"
-```
 
 # NFIU: block a ₦6M transfer (at CTR threshold — routes to human review)
 opa eval -d policies/rego/nfiu-aml.rego \
@@ -187,6 +192,24 @@ opa eval -d policies/rego/popia-south-africa.rego \
   -i examples/inputs/popia-deny-biometric.json \
   "data.agt_policies_africa.popia.decision"
 # → "deny"
+
+# Uganda DPPA: block NIRA national ID in output
+opa eval -d policies/rego/uganda-dppa.rego \
+  -i examples/inputs/uganda-deny-nira-id.json \
+  "data.agt_policies_africa.uganda_dppa.decision"
+# → "deny"
+
+# Tanzania PDPA: block NIDA number in output
+opa eval -d policies/rego/tanzania-pdpa.rego \
+  -i examples/inputs/tanzania-deny-nida-id.json \
+  "data.agt_policies_africa.tanzania_pdpa.decision"
+# → "deny"
+
+# Ethiopia PDP: detect unauthorised access attempt
+opa eval -d policies/rego/ethiopia-pdp.rego \
+  -i examples/inputs/ethiopia-deny-unauthorized.json \
+  "data.agt_policies_africa.ethiopia_pdp.decision"
+# → "deny"
 ```
 
 All example input files are in [`examples/inputs/`](examples/inputs/). See [`docs/compliance-mapping.md`](docs/compliance-mapping.md) for the full mapping of regulatory obligations → Rego rules → expected decisions.
@@ -279,6 +302,9 @@ opa eval -d policies/rego/jurisdiction-router.rego \
 | `NG` | CBN, BVN/NIN, NDPA 2023, NFIU AML |
 | `KE` | Kenya DPA 2019 |
 | `ZA` | POPIA |
+| `UG` | Uganda DPPA 2019 |
+| `TZ` | Tanzania PDPA 2022 |
+| `ET` | Ethiopia PDP (Proclamation 958/2016 + draft PDPP) |
 | `NG` + `transaction_countries: [NG, ZA]` | All 5 — NDPA and POPIA both enforced |
 | Unknown country | Advisory warning returned; action audited |
 
@@ -373,7 +399,12 @@ Every decision is written to a timestamped audit log satisfying NDPA s.30 accoun
 - [x] Kenya Data Protection Act 2019 policy pack (YAML + Rego)
 - [x] NFIU AML/CFT Rego policy — exact CTR threshold enforcement (`nfiu-aml.rego`)
 - [x] POPIA Rego policy — SA ID validation, adequacy list, biometric blocks (`popia-south-africa.rego`)
+- [x] Uganda Data Protection and Privacy Act 2019 — NIRA ID, biometric blocking, PDPO breach notification (`uganda-dppa.yaml` + `.rego`)
+- [x] Tanzania Personal Data Protection Act 2022 — NIDA ID, PDPC breach notification, consent enforcement (`tanzania-pdpa.yaml` + `.rego`)
+- [x] Ethiopia PDP — Fayda ID, unauthorised access detection, ECA breach notification (`ethiopia-pdp.yaml` + `.rego`)
 - [x] Semantic versioning — `CHANGELOG.md` + `REGULATORY-CHANGES.md`
+- [ ] Ghana Data Protection Act 2012 policy pack
+- [ ] Rwanda Data Protection Law policy pack
 - [ ] ECOWAS cross-border transfer rules
 - [ ] SIM swap fraud detection patterns
 - [ ] NAICOM insurtech AI governance rules

REGULATORY-CHANGES.md

@@ -12,6 +12,9 @@ When a regulation updates, open a PR that:
 
 | Date | Regulation | Change | Affected files | Status |
 |------|-----------|--------|---------------|--------|
+| 2026-06-18 | Uganda DPPA 2019 | Initial implementation: s.4 lawful basis, s.13 cross-border, s.19 sensitive data, s.22 security, s.25 breach notification. NIRA ID blocking, biometric deny, PDPO breach suppression, financial data escalation. | `policies/rego/uganda-dppa.rego`, `policies/uganda-dppa.yaml` | ✅ Current |
+| 2026-06-18 | Tanzania PDPA 2022 | Initial implementation: s.8 lawful basis, s.13 sensitive data, s.17 security, s.25 cross-border, s.28 breach notification. NIDA 20-digit ID blocking, biometric deny, PDPC breach suppression, consent enforcement. | `policies/rego/tanzania-pdpa.rego`, `policies/tanzania-pdpa.yaml` | ✅ Current |
+| 2026-06-18 | Ethiopia Proclamation 958/2016 + draft PDPP | Initial implementation: Computer Crime Proclamation 958/2016 (unauthorised access), Electronic Transactions Proclamation 1205/2020, draft PDPP. Fayda/MOSIP ID blocking, unauthorised access detection, ECA breach suppression, cross-border controls. Pack tagged draft — update on enactment. | `policies/rego/ethiopia-pdp.rego`, `policies/ethiopia-pdp.yaml` | ⚠️ Draft — monitor for PDPP enactment |
 | 2026-06-15 | NFIU AML/CFT (MLPPA 2022) | Initial Rego implementation: CTR ₦5M, NIP cap ₦10M, structuring zone, PEP, KYC bypass | `policies/rego/nfiu-aml.rego`, `policies/nfiu-aml-str.yaml` | ✅ Current |
 | 2026-06-15 | POPIA (Act 4 of 2013) | Initial Rego implementation: s.72 adequacy list, SA ID, biometric, children's data | `policies/rego/popia-south-africa.rego`, `policies/popia-south-africa.yaml` | ✅ Current |
 | 2026-06-14 | CBN NIP Framework | Initial implementation: ₦10M single-transaction cap, tiered KYC thresholds, SOD | `policies/rego/cbn-transaction-limits.rego`, `policies/cbn-transaction-limits.yaml` | ✅ Current |
@@ -32,6 +35,9 @@ When a regulation updates, open a PR that:
 | FATF | NFIU / CBN | Nigeria mutual evaluation follow-ups | Biennial |
 | Kenya DPA 2019 | ODPC | ODPC data protection regulations and guidelines | Ongoing |
 | POPIA | Information Regulator SA | Information Regulator guidance notes | Ongoing |
+| Uganda DPPA 2019 | PDPO / NITA-U | Commencement regulations, PDPO enforcement guidelines, adequacy list updates | Ongoing |
+| Tanzania PDPA 2022 | PDPC | PDPC subsidiary regulations, enforcement guidance, adequacy determinations | Ongoing |
+| Ethiopia PDPP (draft) | ECA / MInT | Enactment and gazetting of dedicated Personal Data Protection Proclamation | Critical — review quarterly |
 
 ---