Knowledge, attitudes, behaviour and compliance intentions towards the Data Protection and Privacy Act in Ugandan higher education institutions: the moderating role of educational attainment

Purpose This study aims to examine the influence of knowledge, attitudes and behaviour on compliance intentions towards Uganda’s Data Protection and Privacy Act (DPPA) among staff in Ugandan higher education institutions (HEIs). It further investigates the moderating role of educational attainment in the relationships between knowledge, attitudes, behaviour and compliance intentions. Design/methodology/approach A quantitative cross-sectional survey was conducted among 384 staff members at a large public university in Uganda. Data were analysed using Statistical Package for Social Sciences Version 26 through descriptive statistics, Pearson correlation, multiple regression and hierarchical moderated regression analysis. Findings The results show that knowledge, attitude and behaviour each had a significant positive influence on compliance intentions towards the DPPA. Behaviour emerged as the strongest predictor (ß = 0.434, p < 0.001), followed by attitude (ß = 0.268, p = 0.002) and knowledge (ß = 0.159, p = 0.026). The model explained 56.7% of the variance in compliance intentions (R2 = 0.567). Educational attainment significantly moderated the relationships between knowledge, attitude, behaviour and compliance intentions, increasing the explained variance to 60.7% (R2 = 0.607). These findings suggest that routine privacy-protective behaviour is more influential than knowledge alone in shaping compliance intentions towards the DPPA, and that the effectiveness of these factors varies according to employees’ educational attainment. Practical implications HEIs should prioritise behaviour-focused data protection interventions, tailor staff training to different educational levels and integrate DPPA requirements into institutional policies and routine operational practices to strengthen compliance intentions and promote a sustainable culture of data protection. Originality/value This study extends the information security compliance literature by demonstrating that educational attainment moderates the relationships between knowledge, attitudes, behaviour and compliance intentions towards the DPPA. To the best of the authors’ knowledge, this study provides one of the first empirical examinations of these relationships within Ugandan HEIs, offering context-specific insights for strengthening data protection compliance.