In today’s hyper-connected world, our personal data travels faster and farther than we often realize. Every time we sign up for a service, interact on social media, shop online, or access digital platforms, we leave behind traces of information that can shape our experiences, for better or worse. For many women and girls navigating digital spaces, misuse of personal data isn’t just an inconvenience; it can lead to online and offline harassment, stalking, identity theft, reputational damage, and other forms of Technology-Facilitated Gender-Based Violence (TFGBV).

Uganda’s Data Protection and Privacy Act, 2019 was passed to safeguard your right to privacy and hold individuals, institutions or organizations whether state or non-state accountable when they mishandle your personal data. To enforce this law together with its regulations, Uganda established the Personal Data Protection Office (PDPO), a national body mandated to protect data subjects and ensure data collectors and transmitters comply with the law.

Sadly, many Ugandans especially women and girls still don’t know how to report a violation or seek justice when their data is abused. Whether it’s the unauthorized sharing of your photos, an institution leaking your phone number, apps harvesting your data without consent, or employers misusing your personal information, you have the right to file a complaint and demand accountability.

Below is a clear, simple guide to understanding your rights and taking action when your privacy is violated.

What Counts as a Personal Data Privacy Violation?

You may have grounds to report a violation if any person, company, institution, or digital platform does any of the following without your permission:

• Share your photos, videos, or personal details without consent.
• Exposes your data through a breach or hack due to poor security.
• Use your phone number or email for spam or stalking.
• Collects your data without telling you how it will be used.
• Retains your data longer than necessary.
• Transfers your data outside Uganda without authorization.
• Use your information in ways you did not agree to.
• Publishes private information that puts you at risk.
• Uses your personal information to harass or blackmail you.

How to Report a Personal Data Privacy Violation in Uganda (Step-by-Step)

Step 1: Gather Evidence

Before submitting a complaint, collect all relevant evidence such as:

• Screenshots
• Emails and messages
• Links or posts
• Call records
• Documents showing how your data was misused
• Details of the person or organization responsible

Step 2: Document What Happened

Write down a short account including:

• When the violation occurred.
• How your information was exposed or misused.
• The impact it has had on you (emotional, financial, reputational).
• Any attempts you made to resolve it with the responsible party.

This becomes the basis of your formal complaint.

Step 3: Prepare Your Formal Complaint

Your complaint should clearly include:

• Your full name and contact details.
• A description of the violation.
• The entity or person responsible.
• Evidence attached.
• What you want the PDPO to do (investigate, order deletion, stop misuse, etc.).

Step 4: Submit the Complaint to the Personal Data Protection Office (PDPO)

• Email Submission. Send your complaint and attachments to: info@pdpo.go.ug 
• Physical Delivery. Submit a written complaint to the PDPO headquarters situated at the NITA-U Offices, Palm Courts, Plot 6, Lumumba Avenue, Kampala.
• Online Complaint Form. You may use the digital complaints platform on the official PDPO website.
• Call for Assistance. PDPO also offers telephone support: +256417801008, +256417801009 and +256417801011

Step 5: PDPO Acknowledges and Reviews Your Complaint.

The PDPO typically:

• Reviews your complaint
• Verifies evidence
• Contacts the responsible entity
• Begins the investigation which shall be done within 21 days from the date the complaint is filed.

They may also consult technical experts or law enforcement if the case requires it.

Step 6: Follow Up and Provide Additional Information.

If the PDPO contacts you for:

• More evidence
• A statement
• Clarification

Respond promptly to avoid delays in the investigation.

Step 7: Receive a Decision or Directive

After reviewing your case, the PDPO may issue:

• An order to delete or correct your data
• A directive for the entity to stop using your information
• A fine or sanction on the responsible party
• Guidance on further legal remedies
• Mediation support between you and the offender
• In serious cases, they may refer the matter for prosecution.

Step 8: Appeal If You Are Not Satisfied

If you disagree with their decision, you may file an appeal to the Minister of ICT which shall be made within thirty days from the date of notice of the decision of the PDPO.

Reporting personal data privacy violations is essential because it protects both you and others from future harm, holds individuals and companies accountable, and strengthens Uganda’s overall digital safety ecosystem. It also promotes awareness of digital rights and responsibilities while ensuring that women and girls can participate confidently and safely in online spaces. Your voice matters and by speaking up, including reporting such incidents through WOUGNET’s OGBV web portal at https://ogbv.wougnet.org/ for further guidance and support, you help safeguard your data and that of others.