A critical analysis of criminal liability under Ugandan Data Protection and Privacy Act, Cap 97: a case study of Uganda’s digital lending sector

Abstract

This study examined the effectiveness of Sections 35 to 39 of the Data Protection and Privacy Act, Cap 97 in regulating criminal liability within Uganda‟s digital lending sector. The study specifically assessed the extent to which the Act establishes individual and corporate liability for unlawful processing of personal data, the enforcement challenges faced by the Personal Data Protection Office (PDPO), the deterrent effect of sanctions provided under the Act, and how Uganda‟s criminal enforcement model compares with the administrative enforcement framework under the European Union General Data Protection Regulation (GDPR). The study adopted a descriptive cross-sectional research design using a mixed-methods approach combining qualitative interviews and secondary legal analysis. Data was collected from key informants including officials from the PDPO, the Criminal Investigations Directorate, the Uganda Microfinance Regulatory Authority, the Judiciary, and selected digital lending companies. The findings reveal that while Sections 35 to 39 of the Act provide a strong legal foundation for criminal liability in data protection, enforcement remains limited due to institutional, technological, and jurisdictional challenges. The PDPO faces difficulties in investigating offshore and anonymous digital lenders, as well as, evidentiary constraints in prosecuting digital offences. Although sanctions under the Act, including imprisonment and fines, demonstrate strong legal deterrence in principle, their practical effectiveness is weakened by low monetary penalties and limited enforcement intensity. The study further finds that Uganda‟s enforcement model is more punitive compared to the GDPR‟s administrative approach, which prioritises compliance and corrective enforcement. The study concludes that although Uganda‟s legal framework under the Data Protection and Privacy Act in regulating criminal liability within Uganda‟s digital lending sector is robust in design, its effectiveness depends on strengthened institutional capacity, clearer regulatory guidance, and improved enforcement coordination. Recommendations include strengthening PDPO capacity, clarifying consent standards, enhancing cross-border enforcement mechanisms, and adopting a more balanced enforcement pyramid combining administrative and criminal measures