The Personal Data Protection Office found Google LLC in breach of the Data Protection and Privacy Act 2019 for collecting and processing the personal data of Ugandan citizens without registering as a data controller. It held that Google is a local data controller and that the Act has extraterritorial application under section 1 to any entity handling Ugandan citizens' data, and ordered Google to register and to provide evidence of compliance with cross-border transfer requirements within 30 days.

A leading African determination on the extraterritorial reach of national data-protection law over a global technology platform, turning on the commercial nexus between the operator and local data subjects rather than physical presence. It signals that offshore platforms cannot avoid registration and local obligations by operating from abroad, a posture reinforced when Google withdrew its appeal and agreed to comply.