More than 500,000 firms and organisations are collecting personal data from Ugandans illegally, raising concerns over the safety of people’s national identification details, contacts and other sensitive information.
The Personal Data Protection Office (PDPO) says only about 14,000 organisations are registered to collect and process personal data, meaning hundreds of thousands of entities handling people’s information remain outside the country’s legal data protection framework.
Baker Birikujja, the National Director of the Personal Data Protection Office, said the situation poses a major challenge to Uganda’s efforts to strengthen digital trust and protect personal information.
Birikujja made the remarks during a CEO and board breakfast meeting organised by the Information Systems Audit and Control Association (ISACA) Kampala Chapter, which focused on cybersecurity and digital trust.
He said one of the biggest challenges is limited public awareness about the rights people have over their personal information.
“Once someone collects that information there are certain rights that emanate from that,” Birikujja said.
He explained that individuals have rights over information collected about them, including, in certain circumstances, the right to have it updated, deleted or shared.
Organisations collecting personal data are required by law to register with the PDPO.
Birikujja warned that collecting personal information without registration is not merely a regulatory breach but a criminal offence.
“If you are collecting personal data and you’re not registered, it’s an offence, a criminal one at that,” he said.
The PDPO, he said, has been reminding organisations of their obligations while also working with the Criminal Investigations Directorate and the Office of the Director of Public Prosecutions to take action against non-compliant entities.
The office also maintains a public register where members of the public can check whether an organisation handling their information is registered.
But Birikujja said enforcement alone cannot protect Ugandans if individuals continue giving out personal information without questioning how it will be used.
He urged Ugandans to become more assertive whenever organisations ask for their personal information.
For example, when a person is asked for a national identity card to access a building, Birikujja said they should ask why the information is required, whether another legally recognised form of identification can be used, whether a copy will be made and how long it will be kept.
“Be it government or private sector, you should be assertive. Ask that person,” he said.
He cited cases involving photocopying businesses, where individuals may request several copies of their national identification documents but leave without knowing what happens to the extra copies.
“Once that additional copy is clear, you just pay for the clear copy and walk away. Do you ever ask yourself what happens to the other copies?” he asked.
Birikujja said such practices demonstrate why members of the public need to take greater responsibility for protecting their personal information.
The concerns come as Uganda increasingly shifts services to digital platforms, with citizens using phones and online systems to send money, pay school fees, file taxes, buy insurance and communicate.
Maurice Taremwa, president of the ISACA Kampala Chapter, said digital trust must therefore become a responsibility shared by boards, senior executives, technology professionals and ordinary users.
He said senior managers and boards play a critical role because they approve budgets for cybersecurity, staff training and technologies designed to protect organisations and their customers.
“Please do listen when your technical people are requesting for budget to be able to secure the enterprises, the customers, the clients, the ecosystems that we have,” Taremwa said.
He said Uganda has the capacity to protect itself from cyberattacks but must continuously improve its systems because threats are constantly evolving.
“The way we protected ourselves yesterday is not the same way we have to protect ourselves today,” he said.
Taremwa said digital trust for the ordinary Ugandan means having confidence that a transaction will reach its intended recipient and that a message or communication received online genuinely comes from the person it claims to come from.
He described the state of digital trust in Uganda as “stable but fluid”, saying individual experiences with scams and fraud can quickly undermine confidence in digital services.
Meanwhile, Eric Ssekiziyivu, ISACA Kampala Chapter vice-president and chairperson of the Information Security Conference, said the association will hold the 15th Annual East Africa Information Security Conference at Mestil Hotel from September 14 to 18.
The conference is expected to attract about 500 delegates and will address cybersecurity, artificial intelligence, data privacy, technology governance and risk management under the theme “Securing the Future through Digital Trust.”
Ssekiziyivu said the conference will also feature masterclasses on cybersecurity, artificial intelligence, data analysis and privacy.
