First conviction under data protection law

In a landmark enforcement of Uganda’s data protection and privacy laws, the Personal Data Protection Office (PDPO) has secured its first criminal conviction under the Data Protection and Privacy Act, reports the Daily Monitor. The case – prosecuted in partnership with the Criminal Investigations Directorate and the Office of the Director of Public Prosecutions – marks a critical milestone in holding data controllers and processors accountable under the law. The conviction was entered against Ronald Mugulusi, director of Nano Loans Microfinance Ltd and operator of the Quickloan app. He was prosecuted on two counts: failure to register with the PDPO and violation of individuals’ privacy rights by processing personal data without consent or legal justification, as required by the Act. The offences were committed during the company’s business operations in Kampala between 2023 and 2025. Mugulusi was first arraigned before the Makindye Standards, Wildlife and Utilities Court on 25 April. He pleaded guilty to the first count on 10 July. He entered a plea bargain, voluntarily accepting responsibility and waiving his right to trial. The second count stemmed from a complaint involving the misuse of a borrower’s personal data – including a name, phone number, and photograph – which was recorded in a video and sent via WhatsApp with threats to publish it on TikTok over non-repayment of a loan. While the data was initially shared for loan processing, its use to shame the borrower violated the principle of purpose limitation and lacked legal justification. The matter was later resolved through a court-sanctioned reconciliation. Mugulusi compensated the complainant, Michael Wonambwa, leading to a stay of further proceedings.