Data Protection Compliance in Uganda’s Commercial Sector: Making Data Protection Work for Ordinary Ugandans — A Case Study of Digital Lenders, Telecoms, and Banks
Every time Ugandans register a SIM card, use a loan app, book a ride, or open a bank account, they share personal information. This can include a National Identification Number (NIN), phone number, address, location details, and financial history.
Some loan apps also ask to see a user's contacts, messages and photographs. Many people accept an app's terms without reading them. Even when they do read them, it may be hard to understand what the company can do with their information. People may also be unsure where to complain if their data is misused.
Uganda has a law intended to protect this information: the Data Protection and Privacy Act, Cap. 97 (DPPA), together with the Data Protection and Privacy Regulations, 2021.
This article looks at how those rules apply to digital lenders, telecom operators, delivery and online shopping platforms such as Glovo, businesses such as Cafe Javas, payment services, banks and credit reference bureaus (CRBs). Privacy is a constitutional right under Article 27 of the Constitution of Uganda 1995. Protecting personal data also helps people trust banks and digital services.
But the experience described in this article shows a gap between what the law promises and what happens in practice. The main argument is that Uganda's Personal Data Protection Office (PDPO) needs more independence and stronger powers to make decisions and impose meaningful penalties. The article compares Uganda with Kenya, South Africa, and Nigeria before suggesting changes
The first criminal conviction under the DPPA shows both the promise and the limits of enforcement. In Uganda v Mugulusi (Makindye Standards, Wildlife and Utilities Court, 2025), the director of Nano Loans Microfinance Ltd, operator of the Quickloan app, pleaded guilty on 10 July 2025 to failing to register with the PDPO and was fined UGX 300,000. A second count, arising from a video threatening a borrower with public shaming over an unpaid loan, was resolved by court-sanctioned reconciliation and compensation, so the court made no finding on it (Michalsons, 2025). The PDPO treated the conduct as a breach of purpose limitation, but a penalty of under US$100 is unlikely to deter a business model built on aggressive recovery.
Read the full article below
.jpg)
Comments