Uganda Grapples with Over 500,000 Unregistered Data Collectors

Many Ugandans routinely hand over sensitive personal information, such as National Identification Numbers and addresses, at reception desks or leave photocopies of their IDs at business centers, often without understanding how this data is stored or used. This widespread practice has created a significant data protection crisis, with the Personal Data Protection Office (PDPO) estimating that over 500,000 entities are operating outside the country’s legal framework for handling personal data.

According to Baker Birikujja, the National Director of the PDPO, only around 14,000 organizations are officially registered to manage personal information. The act of collecting data without proper registration is considered a criminal offense. While the PDPO is collaborating with law enforcement agencies to address non-compliance, Birikujja emphasized that legal action alone is insufficient.

Citizens possess legal rights regarding their personal data, including the right to update, share, or erase it. However, a severe lack of public awareness leaves many vulnerable. Birikujja urges Ugandans to become more assertive, questioning institutions about why their data is needed, alternative identification options, data storage practices, and retention periods.

This situation is particularly concerning as Uganda rapidly digitizes services, from mobile money to essential government functions. Maurice Taremwa, President of the ISACA Kampala Chapter, noted that while digital trust is currently stable, it is fragile and can be easily shattered by a single security breach or fraudulent transaction. He stressed the importance of cybersecurity investment by senior executives.

To foster better understanding and capacity in cybersecurity and data protection, the ISACA Kampala Chapter is organizing the 15th Annual East Africa Information Security Conference. The event will bring together regional experts to discuss critical issues like cybersecurity, AI, and risk management. Ultimately, the responsibility for data protection begins with the individual, urging citizens to demand accountability from all entities that collect their personal information.

For more details, visit https://observer.ug/news/over-500000-firms-collecting-ugandans-data-illegally.