Uganda, like many nations around the world, is making remarkable progress in advancing personal data protection and safeguarding individual privacy. For the past four years, the Personal Data Protection Office (PDPO) has been at the heart of this transformation. The establishment of the PDPO marked a turning point in Uganda’s data protection and privacy journey. For the first time, the country has a comprehensive legal and institutional framework designed to ensure that every individual’s personal data, whether collected by a government agency, a telecom company, or a small business, is handled responsibly and securely. The Data Protection and Privacy Act, Cap.97, and its attendant Regulations provide a strong foundation, outlining the duties of data controllers and processors and enshrining the rights of individuals. This right to privacy is also grounded as a fundamental right under Uganda’s 1995 Constitution.
Yet, while the law laid the groundwork, the real challenge has been translating it into daily practice. Many organizations and individuals are still learning what data protection and privacy truly mean. Beyond being a regulatory requirement, it is about respecting human dignity and building public trust in how individuals’ personal data is handled, especially in the digital age.
Recognizing this, the PDPO has taken a proactive role in building awareness and fostering a culture of privacy across all sectors. Over the past four years, the Office has conducted over 500 awareness sessions. These engagements have helped demystify data protection and privacy concepts and empowered both organizations and citizens to understand their roles and rights.
Building on this growing awareness, the PDPO has also invested in automation of compliance and registration processes, making it easier for organizations to register and renew their registration online from the comfort of their workplaces or homes. This digital shift has not only simplified processes but also enhanced monitoring and accountability. To date, 8,770 data controllers and data processors have been registered, reflecting steady progress in compliance across sectors.
Beyond registration, the PDPO also monitors compliance through audits and inspections, over 50 of which have been conducted across various sectors. These exercises help identify gaps, promote corrective action, and strengthen accountability. The Office also receives and investigates complaints from individuals alleging violations of their data protection and privacy rights. Where breaches are established, the PDPO takes enforcement action, including prosecution. In July 2025, the PDPO secured its first conviction under the Data Protection and Privacy Act, Cap. 97 and its Regulations mark a significant milestone in Uganda’s data protection and privacy journey.
Collaboration has been central to these achievements. The PDPO has forged partnerships with regulators, government entities, civil society, and the private sector to strengthen adherence to the law. This collective effort has helped align sectoral practices with national data protection and privacy standards, ensuring that data protection and privacy are not treated as an afterthought but as a cornerstone of service delivery.
The Office has also championed several strategic initiatives to deepen impact, like developing sector-specific compliance toolkits for FinTechs and MSMEs, developing a data protection and privacy training curriculum for the forthcoming Data Protection and Privacy Academy, and translating the Act and its Regulations into braille to make them accessible to persons with visual impairments, among others.
However, no progress comes without challenges. The journey toward full compliance has been met with limited awareness among organizations and individuals alike. Many still view data protection and privacy as a technical or legal matter, not a shared responsibility. This has sometimes led to inconsistent practices and inadvertent data security breaches. Despite these challenges, the PDPO continues to find innovative and collaborative ways to extend its reach and ensure inclusivity of all professions in its work.
At the heart of Uganda’s progress is a simple truth: data protection and privacy are not just about systems, servers, and legal obligations. It’s about people. Every time someone shares their personal details to open a bank account, access healthcare, access a building, or register for a digital service, they are placing their trust in an organization to keep that information safe. Upholding that trust is what drives the PDPO’s mission.
This commitment has taken on new urgency in the digital era. As more Ugandans embrace online services, from e-commerce to mobile banking and social media, the risks of data misuse and cyber threats continue to rise. That is why the PDPO, in collaboration with the National Information Technology Authority, Uganda (NITA-U), is running a nationwide Data Protection and Cybersecurity Awareness Campaign under the theme #BeeraKuGuard, loosely translated as “Stay on Your Guard”.
The campaign is a call to every Ugandan to be more alert, informed, and proactive about their personal data and online safety. It reminds us that protecting privacy is not the responsibility of institutions alone; it begins with individual habits and awareness. Whether it’s using strong passwords, avoiding suspicious links, updating software, or thinking twice before sharing personal details online, small actions make a big difference in building a safer digital community.
We therefore call upon everyone, from business owners to individuals, whether young or old, navigating social media, to get involved. Follow the campaign online, and put the lessons into action. The PDPO and NITA-U have made resources and information available through their websites and social media platforms, making it easy for all Ugandans to learn how to stay safe in the digital space.
The progress made so far is commendable, but the journey continues. Together, through shared responsibility and active participation, we can build a secure, inclusive, and privacy-conscious Uganda.
The Writer is the National Personal Data Protection Director at PDPO