The website goes down on a Saturday. The one day the boutique actually gets orders through Instagram DMs and a link in bio. The owner doesn't call a developer. She calls her nephew, the one doing a diploma in something computer-related at Kyambogo, the one who set up the Wi-Fi at Christmas and fixed her mother's phone.
He comes over after his afternoon lecture. He pokes around. Two hours later it's back up. Nobody signs anything. Nobody asks what actually broke. Everyone moves on, grateful, until the next time.
This is not a joke about African families. This is the actual IT department of most Ugandan small businesses.
The nephew is a rational decision, not a lazy one
Give the owner some credit here. A proper website support retainer costs money she isn't sure the business can spare. A software developer wants a brief, a scope, an invoice. The nephew wants nothing but goodwill and maybe transport. In a market where every shilling is doing three jobs, hiring the free option that shows up in twenty minutes is not stupidity. It is math.
That is exactly why the habit is so hard to break, and exactly why it is worth naming out loud.
What the nephew is actually holding
By the time a business has been running for a year or two, that same informal arrangement is usually managing more than a slow website. It is the person with the admin password to the Instagram page. The one who set up the Mobile Money integration nobody else fully understands. The one holding the only copy of the customer list, in a spreadsheet, on a personal laptop, backed up nowhere.
None of that was a decision anyone sat down and made. It just accumulated, favour by favour, until a stranger with a diploma and good intentions is quietly the most important vendor the business has, without a contract, a backup plan, or an obligation to still be reachable next year.
A report on cybersecurity and data protection for Ugandan SMEs put a plain finding to this: most small businesses here don't have firewalls, don't run antivirus software, and don't back up their data anywhere at all. Multi-factor authentication and staff training barely register. It is not that owners don't care. It is that nobody sat them down and priced out what "care" would actually cost, or what happens the day it isn't there.
Kampala's cybersecurity crowd just spent a week saying the quiet part loudly
This is not a hypothetical worry dreamed up for a blog post. ISACA's Kampala chapter has spent this month running its annual East Africa information security conference under the theme "Securing the Future through Digital Trust," pulling in bank executives, regulators and technology leaders from across the region.
Eric Ssekiziyivu, Vice President of ISACA Kampala, put it simply: cybersecurity, he said, is no longer just about protecting computer systems. It is about protecting public confidence in digital services.
Dr Christine Mujimba of the Uganda Communications Commission made the same point from the regulator's side: secure, trusted digital infrastructure is now essential to Uganda's digital transformation, not a nice-to-have bolted on afterward.
Those two sentences were aimed at banks and telecoms. But mobile money, digital identity and customer data all run through small businesses too, on the same rails, under the same Data Protection and Privacy Act that NITA-U and UCC are increasingly expected to enforce. A boutique with 3,000 customer phone numbers sitting in an unsecured spreadsheet is a smaller version of exactly the problem that conference spent a week discussing.
Building a house, building a business
In Uganda, nobody lets a cousin who watched a YouTube tutorial pour the foundation of a rental house. You hire the fundi, because everyone knows a cracked slab costs ten times more to fix later than to build right the first time. The foundation is the one part of the house you don't gamble on, because it's invisible until the day it isn't.
Most businesses apply the opposite logic to their digital foundation. The website, the customer database, the Mobile Money integration, the social pages that carry the brand, these get the cousin treatment. Cheap, fast, invisible, until the day it cracks.
What actually changes
Nobody is arguing every small business needs a full-time IT department. That is not the point, and it is not realistic. The point is smaller and more specific: know what you're actually running on, and put a real name and a real agreement behind the parts that would hurt to lose.
That means someone accountable for backups that actually run, not backups someone meant to set up. It means the admin logins living somewhere the business controls, not a personal phone that could be lost, sold, or simply switched off. It means one conversation, once, about what happens if the nephew graduates, gets a job in Kigali, and stops answering calls.
None of that requires a big budget. It requires treating the digital side of the business as infrastructure rather than a favour, the same instinct that already tells a builder not to skip the foundation survey.
If you don't know what your own business is actually running on right now, admin passwords included, that's worth a half-hour conversation, not a crisis.
The favour was never free
It felt free because nobody sent an invoice. But every business running its digital foundation on a favour is carrying a bill it hasn't been handed yet, and it rarely arrives on a convenient Saturday.
Fix the foundation before it cracks, not after.
