Privacy Map

Uganda. Comprehensive data protection. Act

DPPAData Protection and Privacy Act, 2019 (Cap. 97)

In force
Partly verifiedMedium confidence. Detail of PDPO's August 2025 registration decision could not be fetched; fee amount from secondary source.

§1Summary

Synopsis

Uganda's data protection law, protecting privacy and regulating collection and processing of personal data by public and private bodies. It is administered by the PDPO and supplemented by the 2021 Regulations.

Key themes
  • registration
  • consent
  • data subject rights
  • breach notification
  • DPO
  • cross-border transfers
Unique features

All data collectors, processors and controllers must register with the PDPO (fee around UGX 100,000), including foreign entities handling Ugandan citizens' data, and must file annual breach summaries. Applies to persons outside Uganda processing data of Ugandan citizens.

SaaS relevance

Foreign SaaS providers processing Ugandan citizens' data are within scope and are expected to register with the PDPO.

§2Obligations

Extraterritorial
Yes
Breach notification
PDPO immediately; PDPO decides on notifying data subjects
DPO
Conditional
Cross-border transfers
Equivalent protection or consent
Maximum penalty
245 currency points per offence; corporations up to 2% of annual gross turnover; up to 10 years' imprisonment

§3Dates

Key dates
  • Adopted
  • In force
  • Data Protection and Privacy Regulations 2021 (S.I. 21 of 2021); PDPO registration decision 2025

§4Text and authority

Text
Authority
Personal Data Protection Office (PDPO), under NITA-U

§5Where it applies

Domestic law of
Uganda

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. Detail of PDPO's August 2025 registration decision could not be fetched; fee amount from secondary source.