Encryption-Based Security Framework for Ensuring Data Privacy and Protection Compliance in Higher Education E-Learning Systems in Uganda

Abstract

Educational institutions increasingly rely on e-learning platforms that store large volumes of sensitive student and staff data, yet many of these platforms continue to lack robust technical safeguards and effective privacy-compliance mechanisms. This study designed and proposed an encryption-based security framework to enhance data privacy and support compliance with Uganda's Data Protection and Privacy Act (DPPA) 2019 in higher education the e-learning system in Uganda, guided by three objectives: assessing the current state of data privacy and DPPA 2019 compliance; establishing the effectiveness of a proposed encryption-based security framework in enhancing confidentiality, integrity, and access control; and determining the degree to which the framework would facilitate regulatory compliance. The study adopted a mixed-methods design combining a quantitative correlational survey and a qualitative case study. A structured questionnaire was self-administered to 120 , and semi-structured interviews were conducted with four key informants from the ICT department. Quantitative data were analysed SPSS using, descriptive statistics, Pearson correlation, and Cronbach's alpha reliability testing; interview data were analysed thematically using Braun and Clarke's six-phase reflexive thematic analysis. The study was theoretically grounded in the Protection Motivation Theory, the CIA Triad, and the NIST Cybersecurity Framework. The study findings revealed moderate data-privacy awareness coupled with high breach anxiety: concern about data breaches and unauthorized use exceeded respondents' confidence in existing protections, while knowledge of who accesses their data of breach-reporting procedures remained low. All inter-objective correlations were statistically significant, with the strongest relationship observed between framework effectiveness and compliance. Reliability across the three objective scales ranged from acceptable. Interviews with ICT staff confirmed that encryption is present but technically opaque, that access controls are undermined by voluntary credential sharing, and that consent is reduced to a click-through formality. Notably, 80.8% of respondents indicated they would increase their e-learning engagement if given greater control over their data. The study concludes that Uganda’s higher education data privacy challenges are fundamentally socio-technical, requiring simultaneous technical reinforcement and human-centred governance. It proposes and recommends the urgent deployment of a six-layer encryption-based security framework comprising data collection and consent, data-at-rest and in-transit encryption (AES-256-GCM, TLS 1.3), role-based access control and multi-factor authentication, integrity and audit logging, compliance and governance, and a user-empowerment dashboard, phased over 36 months and anchored in mandatory data-privacy training and a DPPA 2019-aligned institutional policy.