In April 2025, a client of a Kampala courier company placed an order through Jumia Africa. Somewhere between the warehouse and the doorstep, a delivery agent shared her personal details without her permission.
By December, the finance manager of that company, Vuka Africa Ltd, was standing before a magistrate at the Makindye Standards and Utilities Court. He pleaded guilty to failing to register with Uganda's Personal Data Protection Office. The court fined him five currency points, about UGX 100,000, with two months in prison held in reserve.
It was a small fine. It was also a precedent.
A few months earlier, the director of a digital lender, Nano Loans Microfinance Ltd, had learned the same lesson the hard way. A borrower fell behind on a loan. The director's response was to record a WhatsApp video with the borrower's photo, name and phone number, threatening to post it on TikTok if the debt wasn't paid. In July 2025, he was convicted under the same law. The regulator's own description of the moment was blunt: this was "the beginning of more assertive enforcement, not an isolated incident."
Two companies. Two convictions. One pattern.
Neither business set out to break the law. Both were doing what most Ugandan businesses do: collecting customer names, phone numbers and delivery addresses as a normal part of running an app, a chatbot or a WhatsApp-based order line, with nobody ever asking where that data goes, who can see it, or whether the business was legally required to register as a data processor in the first place.
Most Ugandan business software was built to move fast, not to survive a court date
The Data Protection and Privacy Act, 2019 has been on the books for years. What changed is that the Personal Data Protection Office has started treating it as something more than paperwork. Businesses that process personal data are required to register under Section 5. Administrative fines can run up to 2% of annual turnover. Directors and managers, not just companies, can now carry personal liability. And as the Vuka Africa and Nano Loans cases show, the office is willing to put a real case in front of a real magistrate.
Most of the software running Ugandan SMEs today was never built with any of that in mind. It was built to launch quickly, take orders, and get paid. A WhatsApp group becomes a customer database. A shared Google Sheet becomes a client register. A delivery app logs a customer's name, location and phone number and nobody ever decides who on the team is allowed to open that file.
It is the business version of storing your harvest in a granary with no door. Nobody breaks in because they are clever. They walk in because nothing was ever closed.
Meanwhile, Uganda is training the next builders to close that door from day one
On November 5 and 6, the Uganda Communications Commission ran its Testbed Hackathon at the UICT innovation hub in Nakawa, built around one theme: "Innovating Safer Cyber Spaces for Children through Artificial Intelligence." Forty young technologists, selected from applicants with skills in AI, cybersecurity, mobile networks and software, spent two days building under that brief, organised with netLabs!UG, the Research and Education Network for Uganda, and the Makerere University Technology and Innovation Centre.
It followed UCC's wider Child Online Protection Campaign, launched in October, where the commission's own survey found that 88.5% of students had already experienced some form of online harm and 74.2% never told anyone. The response wasn't just an awareness poster. It was a regulatory framework, a Cabinet-approved communications policy, and now a hackathon asking the country's sharpest young developers to design protection into software from the first line of code.
That is the real gap. One generation of Ugandan builders is being trained, in public, to treat privacy and safety as a design requirement. Meanwhile, a large share of the software currently running Ugandan businesses was built before anyone asked those questions at all.
What this means for the software you are building or buying right now
If you run a business that collects customer names, phone numbers, national ID details or payment information through an app, a website or even a WhatsApp line, ask your developer or agency three things. Is the business registered with the PDPO. Where exactly is customer data stored, and who on the team can access it. What happens, in writing, if that data is ever requested, leaked or misused.
If nobody can answer those clearly, you don't have a data problem waiting to happen. You have one already running in production.
This is the part of software development nobody puts on a pitch deck, and it is exactly the part Make It Happen builds into every system we ship for clients, from the database structure up, not patched on after a regulator calls.
The hackathon cohort in Nakawa is being taught to ask one question before writing any code: who does this protect, and who could it expose. Every Ugandan business running software today should be asking the same question, before a WhatsApp video asks it for them.
