The director of Nano Loans Microfinance Ltd. has been remanded to prison after appearing before the Makindye Standards, Wildlife, and Utilities Court, accused of failing to register with the Personal Data Protection Office (PDPO) and unlawfully processing personal data without consent.
Ronald Mugulusi, who was charged on Friday, April 25, 2025, under the Data Protection and Privacy Act, Cap. 97, and its regulations, pleaded not guilty to both charges. He was remanded until April 30, 2025, when his bail application will be heard.
The prosecution alleges that between 2023 and 2025, Mugulusi and others still at large collected and processed the personal data of Mr. Micheal Wonambwa—including his name, phone number, and facial photo—while operating a digital lending service without registering with the PDPO, as mandated under Section 29 of the Act and Regulation 15(1)(3)(4) of the 2021 Regulations.
It is further alleged that in July 2024, Nano Loans Microfinance Ltd. unlawfully processed Wonambwa’s personal data by recording a video without his consent, in breach of Section 7(1) of the Act and Regulation 34 of the Regulations.
The court heard that the incident arose after Wonambwa sought a Shs60,000 loan through the Quickloan digital app run by Nano Loans Microfinance Ltd. However, after deductions for processing fees, only Shs34,800 was disbursed to him. When the loan repayment date arrived, an agent of the company allegedly sent Wonambwa a WhatsApp message containing a video that displayed his personal information, along with a threat to post it on TikTok if the loan was not repaid.
Wonambwa reported the matter to the PDPO, which, alongside the Criminal Investigations Directorate (CID), conducted investigations. They found that Quickloan is operated by Nano Loans Microfinance Ltd., which had failed to register as a data collector and processor as required by law. Investigators also confirmed that the company processed Wonambwa’s data without his consent.
Click here to join our WhatsApp Group
Experts point out that this case highlights the abusive “borrower-shaming” practices employed by some digital lenders to pressure clients into repayment. It also raises new data privacy concerns: although borrowers provide personal information to access loans, lenders are prohibited from using that data for unrelated purposes like public shaming, according to the principles under the Data Protection and Privacy Act, Cap. 97.
The Personal Data Protection Office (PDPO) serves as Uganda’s independent authority responsible for enforcing the Data Protection and Privacy Act and ensuring proper handling of personal data across the country.
