Over 500,000 firms collecting Ugandans’ data illegally

What the report says

The Observer reports that Uganda’s Personal Data Protection Office says more than 500,000 entities may be collecting and processing personal information without proper registration, leaving many people exposed to possible fraud and identity theft. The article describes common situations in which Ugandans are asked to provide National Identification Card details, phone numbers and home addresses at office receptions, photocopy shops and other service points, often without knowing how the information will be stored or used.

Baker Birikujja, the national director of the PDPO, said collecting personal data without registering with the authority is a criminal offence. He said the office is working with the Criminal Investigations Directorate and the Office of the Director of Public Prosecutions to pursue offenders, but added that enforcement alone will not solve the problem. The report says only about 14,000 organizations are officially registered to handle personal data, far fewer than the total number of entities believed to be processing it.

The story also highlights the role of public awareness and digital trust. Birikujja urged citizens to question why their information is needed, whether alternatives exist, and how long data will be kept. Maurice Taremwa, president of the ISACA Kampala Chapter, said digital trust remains vulnerable and called on company leaders to fund cybersecurity properly. The issue comes as Uganda expands digital services through mobile money, tax systems, schools and insurance platforms.

The article notes that ISACA Kampala Chapter will host the 15th Annual East Africa Information Security Conference at Mestil Hotel from September 14 to 18, bringing together regional experts to discuss cybersecurity, artificial intelligence and risk management.