The National Information Technology Authority Uganda (NITA-U), through its Personal Data Protection Office (PDPO), has warned that individuals and organisations found illegally collecting, publishing or sharing personal data without consent risk facing severe penalties, including up to 10 years in prison.
Speaking during the launch of the “Beera Ku Guard” awareness initiative, PDPO Director Baker Barijjuka said the misuse of personal information remains widespread despite existing legal safeguards.
“It is illegal for anyone or any institution to publish or distribute personal information belonging to others without their knowledge or approval,” Barijjuka said. “The law is clear, and the penalties are serious.”
He cited disturbing cases where personal documents such as academic papers, identification records and medical information have been discarded carelessly, used to wrap food items or publicly exposed without the owners’ consent. Such practices, he said, amount to grave violations of privacy and dignity.
Uganda’s Data Protection and Privacy Act provides a legal framework governing how personal information is collected, processed, stored and shared.
The law applies to both public and private entities and requires that personal data be handled lawfully, fairly and transparently.
Barijjuka warned that the rapid expansion of digital technologies, mobile applications and online services has increased the risk of data breaches and exploitation.
“With more Ugandans transacting, studying and socialising online, the amount of personal data being generated has grown significantly. This creates opportunities for misuse if people and institutions are not careful,” he noted.
He urged citizens to exercise caution when sharing personal information online, avoid clicking suspicious links and verify how organisations intend to use their data before submitting it.
The “Beera Ku Guard” campaign is aimed at strengthening public awareness about data protection rights and responsibilities.
Officials say many Ugandans are still unaware of their rights under the law or the obligations placed on institutions that handle personal information.
The initiative will include community outreach programmes, media engagements and partnerships with public and private sector actors to promote compliance with data protection standards.
Authorities say enforcement efforts are also being intensified. Organisations found in breach of the law may face heavy fines, suspension of operations or criminal prosecution, depending on the severity of the violation.
Barijjuka stressed that safeguarding personal data is not solely the responsibility of regulators but requires collective vigilance.
“Data protection is everyone’s responsibility. Institutions must comply with the law, and citizens must remain alert. When personal data is mishandled, the consequences can be devastating—from financial loss to identity theft and reputational damage,” he said.
As Uganda deepens its digital transformation agenda, regulators say protecting citizens’ privacy will remain central to building trust in online services and ensuring that technological advancement does not come at the expense of fundamental rights.
