When privacy found a voice: Uganda’s journey toward a culture of data dignity

_______________

OPINION

By Baker Birikujja

Uganda, like many nations around the world, is making remarkable progress in advancing personal data protection and safeguarding individual privacy. For the past four years, the Personal Data Protection Office (PDPO) has been at the heart of this transformation.

The establishment of the PDPO marked a turning point in Uganda’s data protection and privacy journey. For the first time, the country has a comprehensive legal and institutional framework designed to ensure that every individual’s personal data, whether collected by a government agency, a telecom company, or a small business, is handled responsibly and securely.

The Data Protection and Privacy Act, Cap.97 and its attendant Regulations provide a strong foundation, outlining the duties of data controllers and processors and enshrining the rights of individuals. This right to privacy is also grounded as a fundamental right under Uganda’s 1995 Constitution.

Yet, while the law laid the groundwork, the real challenge has been translating it into daily practice. Many organisations and individuals are still learning what data protection and privacy truly mean. Beyond being a regulatory requirement, it is about respecting human dignity and building public trust in how individuals’ personal data is handled, especially in the digital age.

Recognising this, the PDPO has taken a proactive role in building awareness and fostering a culture of privacy across all sectors. Over the past four years, the Office has conducted over 500 awareness sessions. These engagements have helped demystify data protection and privacy concepts and empowered both organisations and citizens to understand their roles and rights.

Building on this growing awareness, the PDPO has also invested in automation of compliance and registration processes, making it easier for organisations to register and renew their registration online from the comfort of their workplaces or homes. This digital shift has not only simplified processes but also enhanced monitoring and accountability. To date, 8,770 data controllers and data processors have been registered, reflecting steady progress in compliance across sectors.

Beyond registration, the PDPO also monitors compliance through audits and inspections, over 50 of which have been conducted across various sectors. These exercises help identify gaps, promote corrective action, and strengthen accountability.

The Office also receives and investigates complaints from individuals alleging violations of their data protection and privacy rights. Where breaches are established, the PDPO takes enforcement action, including prosecution.

In July 2025, the PDPO secured its first conviction under the Data Protection and Privacy Act, Cap. 97 and its Regulations mark a significant milestone in Uganda’s data protection and privacy journey.

Collaboration has been central to these achievements. The PDPO has forged partnerships with regulators, government entities, civil society, and the private sector to strengthen adherence to the law. This collective effort has helped align sectoral practices with national data protection and privacy standards, ensuring that data protection and privacy are not treated as an afterthought but as a cornerstone of service delivery.

The Office has also championed several strategic initiatives to deepen impact like; developing sector-specific compliance toolkits for FinTechs and MSMEs, developing a data protection and privacy training curriculum for the forthcoming Data Protection and Privacy Academy, translating the Act and its Regulations into braille to make them accessible to persons with visual impairments, among others.

However, no progress comes without challenges. The journey toward full compliance has been met with limited awareness among organisations and individuals alike. Many still view data protection and privacy as a technical or legal matter, not a shared responsibility. This has sometimes led to inconsistent practices and inadvertent data security breaches. Despite these challenges, the PDPO continues to find innovative and collaborative ways to extend its reach and ensure inclusivity of all professions in its work.

At the heart of Uganda’s progress is a simple truth: data protection and privacy is not just about systems, servers and legal obligations. It’s about people. Every time someone shares their personal details to open a bank account, access healthcare, access a building or register for a digital service, they are placing their trust in an organisation to keep that information safe. Upholding that trust is what drives the PDPO’s mission.

This commitment has taken on new urgency in the digital era. As more Ugandans embrace online services, from e-commerce to mobile banking and social media, the risks of data misuse and cyber threats continue to rise. That is why the PDPO, in collaboration with the National Information Technology Authority, Uganda (NITA-U), is running a nationwide Data Protection and Cybersecurity Awareness Campaign under the theme #BeeraKuGuard loosely translated as “Stay on Your Guard”.

The campaign is a call to every Ugandan to be more alert, informed, and proactive about their personal data and online safety. It reminds us that protecting privacy is not the responsibility of institutions alone; it begins with individual habits and awareness. Whether it’s using strong passwords, avoiding suspicious links, updating software, or thinking twice before sharing personal details online, small actions make a big difference in building a safer digital community.

We therefore call upon everyone, from business owners to individuals, whether young or ol,d navigating social media to get involved. Follow the campaign online, and put the lessons into action. The PDPO and NITA-U have made resources and information available through their websites and social media platforms, making it easy for all Ugandans to learn how to stay safe in the digital space.

The progress made so far is commendable, but the journey continues. Together, through shared responsibility and active participation, we can build a secure, inclusive, and privacy-conscious Uganda.

For more information and updates, visit https://pdpo.go.ug/information-center/resources and www.besafeonline.ug and follow the #BeeraKuGuard campaign on social media.  

The Writer is the National Personal Data Protection Director at PDPO