Uganda

Uganda regulates personal data through the Data Protection and Privacy Act 2019 (Act No. 9 of 2019), which received assent on 28 February 2019 and commenced on 1 March 2019. It is supplemented by the Data Protection and Privacy Regulations, 2021 (SI No. 21 of 2021), which provide operational detail on registration, data protection officers, and impact assessments and are now recorded as a separate Instrument in the Library. The Act applies to any person, institution, or public body collecting, processing, holding, or using personal data in Uganda, and has extra-territorial reach over processors and controllers outside Uganda handling the personal data of Ugandan citizens; personal/household processing and specified national-security activities are exempt. Data collectors and processors must register annually with the Personal Data Protection Office and renew at least three months before expiry, with failure to register a criminal offence. Data subjects have rights to be informed, to access, to correct inaccurate data, and to compensation for damage or distress caused by a contravention, alongside protections around automated decision-making. A distinctive feature is the narrow cross-border transfer regime: transfers are permitted only where the destination country ensures adequate protection, and data-subject consent is the only expressly recognised alternative mechanism, the Act does not, unlike many peers, provide for standard contractual clauses or binding corporate rules. Criminal penalties run from fines and short custodial terms for registration failures to more serious sanctions for unlawfully obtaining, disclosing, or selling personal data. Enforcement is carried out by the Personal Data Protection Office (PDPO), an independent office within the National Information Technology Authority - Uganda (NITA-U), operationalised in August 2021. With a primary Act, supporting 2021 Regulations now documented, and an operational regulator, Uganda is a multi-instrument jurisdiction with a working, in-force regime, though its transfer mechanism is unusually restrictive.