Practical steps, local risks, and how to report
In Uganda, the Data Protection and Privacy Act (DPPA) 2019 sets out how organizations and individuals must handle personal data, and it created the Personal Data Protection Office (PDPO) to enforce the law and handle complaints. The Act defines personal data broadly and establishes principles like lawfulness, transparency, and data minimization, alongside rights for individuals (access, correction, erasure).
A special focus locally is the National Identification Number (NIN). Because the NIN is required for SIM registration, mobile money, banking, tax, and accessing many public services, careless sharing of your NIN can expose you to fraud or identity misuse.
At the same time, Uganda’s rapid digital adoption has expanded mobile money and online services, but it’s also fueled digital scams. The Uganda Communications Commission (UCC) provides clear guidance on mobile fraud, including SIM‑swap, smishing (fraudulent SMS), and vishing (fraudulent calls). These attacks often aim to take over phone numbers and reset credentials for banking or social media.
Practical steps you can take today:
- Use strong, unique passwords. Don’t reuse the same password; consider a passphrase and a reputable password manager. It is recommended to move beyond “easy to guess” passwords.
- Turn on Two‑Factor Authentication (2FA). Enable 2FA on email, social media, and financial apps.
- Protect your NIN and ID documents. Avoid sharing or lending your NIN; treat it like a signature tied to your identity.
- Harden your mobile money. Keep your PIN secret; never share it with agents or callers. Verify caller identities via official hotlines and confirm recipient names before sending.
- Be phishing‑smart. Don’t click unknown links; be wary of “urgent” messages about promotions, job offers or lottery wins. Recent public awareness efforts (UCC, BoU, Airtel/MTN campaigns) have flagged rising mobile scams and urged vigilance.
- Keep your devices and apps updated to patch security flaws. Use a strong screen lock (PIN, password, or biometric) and enable automatic updates. Install reputable antivirus or mobile security apps, avoid downloading apps from unknown sources, and regularly review app permissions. Finally, back up your data and enable “Find My Device” or similar features to locate or wipe your device if lost.
- Limit what you share. Avoid posting your address, ID photos, travel plans, or images of official documents online. This reduces social‑engineering risk.