Gulu | When John [not real name] first saw his private WhatsApp messages quoted back to him by a debt collector, he thought his phone was haunted.
However, the reality was far more chilling: a lending app on his device had silently siphoned his contacts, gallery, and chat history, then weaponised them to pressure him into repayment.
On the other hand, the Ugandan had promised protection, but the fine levied on the company amounted to less than a dollar.
Thus, this silent data haemorrhage is now the defining and largely unreported consumer crisis facing Uganda’s digital boom.
While headlines focus on internet shutdowns, a deeper threat is quietly stripping citizens of their privacy and the unchecked exploitation of personal data by financial apps, mobile money agents, and even government contractors.
“Media personnel are not just reporters of online harms, and they are the first line of amplification,” said Bernard Bwambale, Head of Programs at the Global Consumer Centre (CONSENT), during the launch of the “Safer Internet Media League Series.”
He noted that with over half of Ugandans now active online, incidents of cyberbullying, misinformation, online fraud, and data breaches have surged.
“We can equip you with the right knowledge on cybersecurity, data privacy, and consumer protection, and you will carry that message to every homestead in Uganda,” Bwambale added.
Despite Uganda’s six-year-old Data Protection and Privacy Act (DPPA), enforcement has been notoriously weak.
In addition, a landmark case last year saw Ronald Mugulusi, director of Nano Loans Microfinance Ltd (operator of the Quickloan app), convicted of processing personal data without consent a,nd Mugulusi was fined just shs300,000 – approximately USD 80.
Mugulusi had created and disseminated a WhatsApp video containing a borrower’s photograph, name, and contact information, threatening public exposure on TikTok if the loan remained unpaid.
Despite this egregious violation, the “historic” conviction sent a message not of deterrence, but of impunity.
A recent report by Unwanted Witness flagged major data protection gaps in Uganda’s 2026 general elections, noting that personal data collected for civic purposes appeared to be “recycled into campaign infrastructure,” violating principles of lawful processing.
Researchers describe the 2026 elections as Uganda’s “most technologically intensive electoral cycle,” yet consent mechanisms were notably absent.
Mobile money agents have also been caught in the act. In May 2026, a Kampala court fined three agents shs120,000 each for unlawfully obtaining and disclosing a client’s personal data.
The regulatory reckoning
In response to the crisis, the National Information Technology Authority Uganda (NITA-U), through its Personal Data Protection Office (PDPO), recently launched the “Beera Ku Guard” awareness campaign.
Additionally, the campaign warns that illegal collection or sharing of personal data can attract up to 10 years in prison.
“It is illegal for anyone or any institution to publish or distribute personal information belonging to others without their knowledge or approval,” said PDPO Director Baker Barijjuka.
He cited disturbing cases where personal documents s,uch as academic papers and medical information h,ave been discarded carelessly or used to wrap food items.
However, critics argue that awareness campaigns mean little without genuine enforcement and for every high-profile case, thousands of Ugandans continue to unknowingly surrender their digital rights in exchange for small loans or internet access.
Why it matters for journalists and citizens
For journalists like John w,ho have covered multiple elections and witnessed government surveillance firsthand t,he stakes are existential.
“If a loan app can mine my contacts, what stops a hostile state from doing the same to my sources?” he asked.
“Our Data Protection Act exists on paper, but in practice, your consent is just a checkbox you tick to use a service a,nd we need a fundamental shift from passive acceptance to active digital citizenship,” he added.
Bwambale echoed this call to action n,oting that journalists shape online bebehaviourvery time they write a story, share a post, or interview a victim of cybercrime.
He emphasised that the Safer Internet Media League Series, an eight-part training marathon, aims to tuequipedia professionals into berontline defenders of online safety, giving them the tools to report accurately, ethically, and safely.
Therefore, for Ugandans, the path forward requires more than government action a,nd citizens must exercise caution when sharing personal information online, avoid clicking suspicious links, and verify how ororganisationsntend to use their data before submitting it.
Barijjuka stressed that data protection is everyone’s responsibility, warning that when personal data is mishandled, the consequences can be devastating f,rom financial loss to identity theft and reputational damage.
As Uganda deepens its digital transformation, the question remains whether the state will prprioritisehe privacy of its citizens or continue to allow a culture of exploitation to flourish.
Discover more from tndNews, Uganda
Subscribe to get the latest posts sent to your email.
