The next time a security guard asks for your National Identification Number before allowing you into a building, ask a simple question: who gave that organization the right to collect it, and what happens to it after you leave? That question goes to the heart of Uganda’s growing digital economy. The Personal Data Protection Office (PDPO) says only about 14,000 organizations are officially registered to handle personal information, while more than 500,000 entities, including businesses, schools, hospitals and informal vendors, are collecting or processing data outside the legal framework. That gap is not merely bureaucratic. It exposes a deeper governance failure: Uganda is digitizing faster than it is building a culture of accountability around the information that makes digital services possible. Citizens routinely surrender NINs, telephone numbers, addresses and photocopies of national IDs with little idea where that information goes. Yet these aren’t harmless pieces of paper. In an economy increasingly dependent on mobile money, electronic school payments, tax systems and insurance platforms, personal information has become valuable infrastructure, and, in the wrong hands, a potential gateway to fraud and identity theft. PDPO National Director Baker Birikujja says collecting personal data without registration is a criminal offence. Citizens also have rights over information held about them, including, in certain circumstances, having it corrected, shared or erased. His advice is strikingly basic: “Be it government or private sector, you should be assertive. Ask that person.” But individual vigilance cannot substitute for institutional responsibility. Uganda needs enforcement that makes unlawful data collection costly enough to change behaviour. Organizations collecting personal information should know exactly what they may collect, why they need it, how long they can retain it and who may access it. Registration must be accompanied by meaningful compliance, audits and consequences for abuse. Corporate boards must also treat cybersecurity as a governance responsibility, not an IT department expense. ISACA Kampala Chapter president Maurice Taremwa is right to urge executives to fund security properly. Digital trust can disappear after a single fraudulent transaction. Most importantly, Ugandans must stop treating demands for personal information as automatically legitimate. A national ID should identify its owner, not become an open licence for strangers to harvest their identity. Uganda cannot build a trusted digital economy while hundreds of thousands of data collectors operate beyond effective oversight. The country’s digital transformation will ultimately be judged not by how much information it can collect, but by how safely it can protect the people behind that information.The post Your NIN is your identity, stop giving it away appeared first on The Observer Media Ltd.