Kampala, Uganda: The Makindye Grade One Magistrate’s Court has fined a 31-year-old businesswoman Shs100,000 or sentenced her to two months in prison for unlawfully obtaining and disclosing a client’s personal data.
Finah Atlist, a resident of Kalerwe Zone in Kampala, was convicted and sentenced on Friday by Grade One Magistrate Geoffrey Akena after entering a plea bargain agreement with the prosecution.
A plea bargain is an arrangement in which an accused person admits guilt in exchange for a reduced sentence. “You are convicted on your plea of guilty,” Magistrate Akena ruled.
Court heard that in October 2025, Atlist and other suspects still at large, while acting as agents of Gold Credit, an online money lending application, unlawfully obtained and disclosed the National Identity Card details of a client, Apecho Oliver, to third parties without authorisation.
Atlist pleaded guilty to unlawfully obtaining and disclosing personal data contrary to Section 35 of the Data Protection and Privacy Act, 2019, and Regulation 34 of the Data Protection and Privacy Regulations.
She also admitted operating without registering with the Personal Data Protection Office, contrary to Section 29(3) of the Data Protection and Privacy Act.
Atlist’s conviction comes amid growing concerns about personal data protection in Uganda as digital financial services continue to expand.
The Data Protection and Privacy Act, 2019 regulates the collection, processing, storage and sharing of personal information. However, digital rights advocates argue that data breaches remain widespread due to weak enforcement, rapid digitalisation and limited public awareness about privacy rights.
Recent findings by digital rights organisation Unwanted Witness suggest Uganda continues to face significant challenges in protecting citizens’ personal information.
Digital rights experts have repeatedly warned that the increasing use of mobile lending applications, online financial services and digital platforms has heightened the risk of misuse of personal information, particularly where compliance with data protection laws remains weak.
The case is among a growing number of prosecutions aimed at enforcing Uganda’s data protection and privacy laws as authorities seek to strengthen accountability in the handling of personal information.
If you would like your article/opinion to be published on Uganda’s most authoritative news platform, send your submission on: [email protected]. You can also follow DailyExpress on WhatsApp and on Twitter (X) for realtime updates.
