Over 500,000 firms collecting Ugandans’ data illegally

Every day, thousands of Ugandans walk into office buildings, hand over their National Identification Cards at the reception desk, and watch security guards jot down their NINs, phone numbers, and home addresses into open registers.

Others leave clear photocopies of their national IDs sitting on the counters of urban secretarial bureaus after printing a single copy. Few ever stop to ask what happens to that information once they walk away.

That widespread indifference is now exposing millions of citizens to potential fraud and identity theft, as regulators reveal that over 500,000 entities in Uganda are collecting and processing personal data outside the law.

According to the Personal Data Protection Office (PDPO), only about 14,000 organizations in the country are officially registered to handle personal information. This leaves hundreds of thousands of businesses, schools, hospitals, and informal vendors operating completely outside Uganda’s legal data protection framework.

Baker Birikujja, the National Director of the PDPO, warned that collecting personal data without registering with the authority is not merely an administrative oversight, it is a criminal offence.

Speaking during an executive breakfast meeting organized by the Information Systems Audit and Control Association (ISACA) Kampala Chapter, Birikujja noted that while his office is partnering with the Criminal Investigations Directorate (CID) and the Office of the Director of Public Prosecutions (ODPP) to crack down on offenders, legal action alone cannot solve the crisis.

Man inserts National ID in his wallet

“Once someone collects that information, there are certain rights that emanate from that,” Birikujja said, explaining that citizens legally hold the right to have their personal details updated, shared, or completely erased under specific circumstances.

Instead, a severe lack of public awareness leaves ordinary Ugandans vulnerable at the point of collection. Birikujja urged citizens to start challenging institutions and service providers whenever they demand personal details.

“Be it government or private sector, you should be assertive. Ask that person,” Birikujja urged.

He stressed that citizens entering premises should routinely ask why their ID details are needed, whether alternative identification can be used, if copies are being stored, and how long the data will be kept.

He pointed directly to local photocopying shops as a prime example of daily vulnerability, where clear copies of national identity documents are routinely left behind on counters without a second thought.

“Once that additional copy is clear, you just pay for the clear copy and walk away,” he noted.

“Do you ever ask yourself what happens to the other copies?” This vulnerability comes at a time when Uganda is rapidly digitizing public and private services. From mobile money transfers and school fee payments to filing tax returns and accessing insurance, everyday life is increasingly tied to digital networks.

Maurice Taremwa, President of the ISACA Kampala Chapter, described the current state of digital trust in Uganda as “stable but fluid,” pointing out that a single phone scam or fraudulent transaction can instantly shatter a citizen’s confidence in digital platforms.

Taremwa argued that building digital trust requires board members and senior executives to stop treating cybersecurity as an administrative burden and start funding it properly.

“Please do listen when your technical people are requesting for budget to be able to secure the enterprises, the customers, the clients, the ecosystems that we have,” Taremwa said, warning that security measures must constantly evolve to keep pace with sophisticated cyber threats.

To address these vulnerabilities and build institutional capacity, the ISACA Kampala Chapter is organizing the 15th Annual East Africa Information Security Conference at Mestil Hotel from September 14 to 18.

Led by conference chairperson Eric Ssekiziyivu, the gathering of 500 regional experts will focus on cybersecurity, artificial intelligence, and risk management, alongside practical masterclasses on data analysis and privacy.

For ordinary Ugandans, however, the ultimate takeaway is immediate: digital protection does not start in server rooms or regulatory offices; it starts at the front desk, the secretarial bureau, and the mobile money kiosk.

Until citizens begin demanding accountability for their personal data, half a million unregistered entities will continue operating in the dark.

The post Over 500,000 firms collecting Ugandans’ data illegally appeared first on The Observer Media Ltd.