Court fines mobile money agents over data breach

From left, Peter Mawande, 25, Sadam Hussein, 20, and Lydi Kanyesigye, 34, who are charged with unlawful obtaining and disclosure of personal data. PHOTO/GEOFREY MUTUMBA.

Court in Kampala has convicted three mobile money agents for unlawfully obtaining and disclosing a client’s personal data, highlighting growing concerns over data protection in the country’s expanding digital economy.

The convicts, Peter Mawande, 25, Lydia Kanyesigye, 34, and Hussein Sadam, 20, were each fined Shs120,000 or, in default, face three months in prison.

The trio, agents of Easy Pesa, an online lending company, are residents of Kitintale and Bugolobi in Kampala and Nansana in Wakiso District.

Court heard that the three, together with others still at large, in July 2025 unlawfully obtained and shared personal data belonging to Max Ntambazi from his national identity card without legal authority.

Makindye Chief Magistrate Asuman Muhumuza delivered the ruling on May 5 after the accused entered a plea bargain agreement with the prosecution.

“You are convicted on your plea of guilty,” Muhumuza said.

Under a plea bargain, an accused person agrees to plead guilty in exchange for concessions such as reduced charges or a lighter sentence.

The accused pleaded guilty to unlawful obtaining and disclosure of personal data, contrary to Section 35 of the Data Protection and Privacy Act, 2019, and Regulation 34 of its accompanying regulations.

They also admitted failing to register with the Personal Data Protection Office, in violation of Section 29(3) of the same law.

Uganda’s Data Protection and Privacy Act regulates the collection and processing of personal information. However, breaches remain common amid rapid digitalisation, weak enforcement and limited public awareness.

A recent survey by civil society organisation Unwanted Witness found that Uganda continues to lag behind regional peers in safeguarding personal data.

The study, conducted between January and September 2023 across Uganda, Kenya, Zimbabwe and Mauritius, assessed 48 companies in sectors including telecommunications, e-commerce, financial services, digital lending and online betting.

Kenya recorded the highest compliance score at 47.3%, while Zimbabwe ranked lowest at 23.1%.

By sector, e-commerce scored highest at 50.1%, followed by digital lending services at 44.9%. Telecommunications and financial services both scored 39.7%, while online betting stood at 33.8%. E-government ranked lowest at 11.1%.