If a stranger knew everything your phone knows about you, would you sleep peacefully? It is an uncomfortable question, but it is one we cannot avoid. Every time we register a SIM card, apply for a job, or download an app, we leave behind digital traces of ourselves. Names, phone numbers, national ID details, photographs, and even biometric data quietly move from our hands into systems we do not control. A phone number here. A photocopy of an ID there. A quick selfie for verification. We give away pieces of ourselves every day often without a second thought.
This year’s Data Privacy Day theme for Uganda, “Personal data: guard it like it’s your own” challenges us to confront a simple truth. Personal data has become one of the most valuable and vulnerable assets in Uganda’s digital economy, validating Meglena Kuneva’s observation, former European Union Consumer Commissioner, that personal data is the new oil of the internet and the new currency of the digital world. Personal data fuels mobile money, social media, online shopping, job applications, healthcare systems, among others. Yet while we guard our phones, wallets, and homes with fierce attention, we often treat our personal data like it’s disposable.
It isn’t.
Important to note is that personal data is personal power. In the wrong hands, it can empty bank accounts, ruin reputations, enable surveillance, or expose people to real-world harm. Once lost or misused, it is rarely recovered.
Digital convenience has trained us to click “accept” without reading, to share without asking questions, to trust without verifying. We post birthdays, locations, workplaces, family photos, and daily routines online, unaware of how easily these details can be stitched together. But this convenience comes at a cost. Every click, tap, or share can quietly put your personal data at risk.
For many Ugandans, the risks feel distant until they are not. In July 2025, the Standards, Utilities and Wildlife court in Uganda convicted a mobile lending app operator under the Data Protection and Privacy Act Cap. 97 when he was found guilty of illegally collecting and misusing personal data. Recent reports show that cybercrime cases in Uganda are rising. In 2024, police recorded 474 cybercrime cases with financial losses of about UGX 72.1 billion. These incidents show how everyday information can be weaponized.
But who should be protecting our data?
Uganda’s Data Protection and Privacy Act, Cap.97 recognizes that personal data deserves protection and that misuse has consequences. Organizations are required to collect only what they need, secure it properly, and respect the rights of individuals or what the Act refers to “data subject rights.” But laws do not enforce themselves. Data protection fails when organizations treat personal information casually for example; stored on unsecured devices, shared over WhatsApp, or accessed by people with no real authority.
When institutions fail to guard data like it’s their own, the public pays the price. Still, it would be dishonest to place all the blame elsewhere. We are often our own weakest link. Why?
We overshare, we reuse passwords, we hand over personal details simply because someone asks, we click accept without reading the terms and conditions etc. Guarding personal data like it’s your own means slowing down. Asking why information is needed. Questioning who will access it. Thinking twice before posting, forwarding, or filling in that form. Privacy begins with awareness and awareness begins with care.
Therefore “Personal data: guard it like it’s your own” is a reminder and a warning.
If you wouldn’t leave your door unlocked for strangers, don’t leave your data exposed. If you wouldn’t hand your wallet to someone you don’t trust, don’t hand over your information without thinking.
As Uganda continues its digital transformation journey, the future will belong to those who understand this simple truth; personal data is not cheap, casual, or replaceable. It is valuable. It is powerful. And it deserves protection every single time.
A happy International Data Privacy day 2026!
The writer is the Communications Officer at the Personal Data Protection Office.