More than 500,000 firms, businesses and organisations in Uganda are collecting and processing personal information without registering with the country’s data protection regulator which risk security of citizens’ national identification details, telephone contacts and other sensitive information.
The revelation was made by Baker Birikujja, National Director of the Personal Data Protection Office (PDPO), who said only about 14,000 organisations have so far registered to lawfully collect and process personal data.
The figure means that a vast number of entities handling Ugandans’ personal information remain outside the formal regulatory framework established to protect people from misuse, unauthorised disclosure and other forms of data abuse.
Birikujja was speaking at a Chief Executive Officers and board members’ breakfast meeting organised by the ISACA Kampala Chapter, where cybersecurity, privacy and digital trust were discussed.
He warned that the scale of non-compliance presents a significant challenge as Uganda rapidly expands the use of digital services and systems that require people to surrender personal information.
“Once someone collects that information there are certain rights that emanate from that,” Birikujja said.
Under Uganda’s Data Protection and Privacy Act, 2019, organisations collecting, processing or holding personal data are required to comply with the law, while the PDPO maintains a register of authorised data controllers and processors. The regulator’s online register currently lists more than 13,500 registered entities.
The law applies not only to organisations operating inside Uganda but also to entities outside the country that collect, process, hold or use personal information relating to Ugandan citizens.
Birikujja said registration is not an optional administrative requirement and warned organisations that collect personal information without complying with the law.
“If you are collecting personal data and you’re not registered, it’s an offence, a criminal one at that,” he said.
The PDPO has been working with the Criminal Investigations Directorate and the Office of the Director of Public Prosecutions to pursue cases involving non-compliant data handlers.
The regulator has already demonstrated its willingness to pursue criminal enforcement. In July 2025, the PDPO announced its first criminal conviction under Uganda’s data protection law against Ronald Mugulusi, director of Nano Loans Microfinance Ltd and operator of the Quickloan application. He was convicted over failure to register with the PDPO and processing personal data without consent or another lawful basis.
The PDPO says registration promotes transparency by enabling members of the public to establish who is collecting or processing their information and for what purposes. Every data collector, processor or controller is required to register unless specifically exempted by law.
Birikujja said enforcement by the regulator alone will not be enough unless Ugandans themselves become more conscious of how and why their personal information is collected.
He urged citizens to question organisations whenever they are asked to provide sensitive documents such as national identity cards.
For instance, a person asked to surrender an identity card to gain access to a building should establish why the information is necessary, whether another form of identification would be accepted, whether a copy will be made and how long the information will be retained.
“Be it government or private sector, you should be assertive. Ask that person,” he said.
He also raised concern about the common practice of photocopying national identification documents, saying people often have no idea what happens to additional copies made by businesses.
“Once that additional copy is clear, you just pay for the clear copy and walk away. Do you ever ask yourself what happens to the other copies?” he asked.
The PDPO provides members of the public with avenues to check whether organisations handling their information are registered and to lodge complaints over suspected breaches or violations of their rights. The regulator also outlines rights including the right to be informed and the right to complain about breaches and non-compliance.
The growing concern over personal information comes at a time when Ugandans are increasingly relying on digital platforms for banking, mobile money, tax services, education, insurance, shopping, government services and communication.
As more transactions move online, the amount of personal and financial information held by companies and institutions is also increasing, making cybersecurity and data governance increasingly important.
Digital trust requires investment
Maurice Taremwa, president of the ISACA Kampala Chapter, said protecting personal information should not be left to information technology departments alone.
He called on company boards and senior executives to support cybersecurity teams with adequate resources for security systems, staff training and other measures designed to protect organisations and their customers.
“Please do listen when your technical people are requesting for budget to be able to secure the enterprises, the customers, the clients, the ecosystems that we have,” Taremwa said.
He said Uganda has the capacity to withstand cyber threats but must continually strengthen its defences because cyber risks are constantly changing.
“The way we protected ourselves yesterday is not the same way we have to protect ourselves today,” he said.
Taremwa described digital trust from an ordinary citizen’s perspective as confidence that a digital transaction will reach its intended recipient and that online communications are genuinely coming from the people or organisations they claim to represent.
He said digital trust in Uganda remains “stable but fluid”, warning that individual experiences with fraud, scams or security breaches can quickly undermine confidence in digital services.
The concerns also come as Uganda continues to pursue wider digital transformation, making the protection of personal information a key component of public confidence in technology.
Meanwhile, Eric Ssekiziyivu, ISACA Kampala Chapter vice-president and chairperson of the Information Security Conference, said the organisation is preparing for the 15th Annual East Africa Information Security Conference.
The conference is scheduled for September 14 to 18, 2026, at Mestil Hotel and Residences in Kampala and will bring together cybersecurity, audit, governance, privacy, risk and technology professionals from across the region.
The event will be held under the theme “Securing the Future through Digital Trust” and will focus on cybersecurity, artificial intelligence, data privacy, technology governance, risk management and digital resilience.
According to the conference organisers, the programme will include masterclasses and technical sessions covering areas such as artificial intelligence, cybersecurity and data privacy and compliance.
The conference will provide another platform for businesses, regulators and technology professionals to examine how Uganda and the wider East African region can strengthen digital systems while ensuring that the personal information entrusted to them is protected.
