Evaluation of the Enforcement Capacity of Uganda's Data Protection and Privacy Act Cap 97 in the Age of Big Tech and Digital Lending

The personal data of Ugandans has become a resource of immense value and a site of serious risk. Global technology firms build their business on the collection and monetisation of personal data, and a rapidly growing digital-lending industry extends credit through mobile applications that harvest the data on a borrower's device, often abusively. Against this background, Uganda enacted a modern data-protection law, now the Data Protection and Privacy Act Cap 97, to protect personal data and to give effect to the constitutional right to privacy. This article evaluates the enforcement capacity of that Act in the age of big tech and digital lending. It sets out the concepts of data protection, the data economy and digital lending; it examines the legal framework, comprising the Constitution, the Data Protection and Privacy Act Cap 97 and its Regulations, and the related Computer Misuse Act Cap 96, Electronic Transactions Act Cap 99, National Payment Systems Act Cap 59 and Financial Institutions Act Cap 57; and it analyses the enforcement machinery, the Personal Data Protection Office and its first enforcement actions, including the Nano Loans and Quickloan matter that produced the first conviction under the Act, together with the comparative authority of Google Spain, Carpenter v United States and the Kenyan Nubian Rights Forum case. The article argues that, although the Act is substantively sound, its enforcement capacity, measured against the scale, sophistication and cross-border character of big tech and digital lending, remains inadequate, and it recommends the strengthening of the regulator's independence, funding and technical capacity, the coordination of the data-protection, financial and payment-system mandates, the strengthening of sanctions, and the promotion of public awareness.