Fintech-related grievances made up roughly 40 percent of all complaints lodged with the Personal Data Protection Office (PDPO) during the previous financial year.
Digital lenders and fintech platforms triggered nearly 40% of last year’s privacy grievances.
The PDPO issued over 300 compliance notices under the Data Protection and Privacy Act, targeting the digital lending sector heavily.
National Data Protection Director Baker Birikujja stressed issues surrounding data collection, access limits, and privacy violations during borrower defaults.
He raised concerns about the growing data protection risks associated with digital lending and fintech services, with fintech-related complaints accounting for approximately 40 percent of complaints received by the Office during the last financial year.
Digital financial services are changing how people access and use financial services across East Africa.
As digital lenders and fintech companies increasingly rely on personal data to provide these services, questions around how that data is collected, used, shared, and protected have become an important part of the legal and regulatory conversation.
These issues were at the centre of the 5th Unwanted Witness Moot Court Competition, organised under the theme “Protecting Personal Data in Digital Financial Services and Fintech Ecosystems in East Africa.” The 2026 Moot, hosted by Uganda Christian University (UCU), brought together law students from universities across East Africa to discuss emerging issues of data protection and privacy in Uganda’s digital landscape.
Speaking at the event, the National Personal Data Protection Director, Baker Birikujja, highlighted the growing data protection concerns within the digital lending sector. He noted that complaints related to the fintech sector accounted for approximately 40 percent of the complaints received by the Personal Data Protection Office (PDPO) in the last financial year, highlighting the growing privacy and data protection concerns associated with digital financial services.
He urged digital lending and fintech players to consider the key data protection principles throughout the processing of personal data, including what data is being collected, why it is being collected, who has access to it, and whether the processing is proportionate to the intended purpose. He also raised questions about how personal data should be handled when a borrower defaults or is at risk of defaulting, particularly where the processing or sharing of that information may affect the individual’s privacy.
Birikujja noted that the PDPO has issued over 300 notices under the Data Protection and Privacy Act, Cap. 97 with the majority relating to the digital lending sector, highlighting the level of regulatory attention the sector continues to receive.
“The next generation of lawyers and regulators must think beyond national legal systems and understand how law, technology, commerce and fundamental rights interact with each other across the region,” said Mr. Birikujja.
He urged the participants to appreciate these interactions, particularly as new technologies, automated decision-making, and digital identities continue to emerge.
Addressing the broader implications of technological advancement, Rt. Hon. Justine K. Lumumba, the Minister of ICT and National Guidance, noted that with the evolving era of AI and technological advancement, Government is continuously digitising public services, with other sectors increasingly adopting digital systems.
“AI and digital systems are not something we can avoid, but we can exercise prudence as we utilise them,” she stated.
She encouraged Ugandans to take advantage of AI while remaining vigilant about the challenges that accompany technological development, particularly those relating to data privacy and, highlighted consent as one of the issues requiring attention, especially in situations where students’ names and photographs are published across platforms for announcements, advertising or communication of results.
The discussions at the Moot Court stressed the need for future legal practitioners to understand the intersection between technology, financial services, privacy and fundamental rights as digital services continue to evolve across the region.
Through initiatives such as the Unwanted Witness Moot Court Competition, the PDPO continues to support platforms that expose future legal practitioners to the practical data protection questions emerging alongside technological change.
