Uganda

Section 1 of the Data Protection and Privacy Act (Act 9 of 2019, now consolidated as Cap. 97) sets out who it covers. It covers a person, institution or public body that collects, handles, holds or uses personal data within Uganda. It also covers one outside Uganda that does the same with personal data about Ugandan citizens. The hook is citizenship, not where the person lives. The Act does not use a targeting test, or an 'offering goods and services' test, the way Europe and India do. Sections 29 and 30 require the Authority to keep a data protection register. It covers every person, institution or public body that collects or handles personal data. It must be open to public inspection. The regulator's own portal runs registration, annual renewal, changes of details and de-registration. The Act does not itself require a named local representative. The 2021 Regulations do require a data protection officer.

Section 19 of the Act is the whole general rule, and it is two lines long. Industry by industry. BANKING: a copy must stay in the country The Financial Institutions Act, Cap. 57 requires a licensed institution to keep its financial ledgers and records in Uganda. Necessary non-financial records must also be kept within Uganda. PAYMENTS: data can leave only if conditions are met, with a firm gate. The National Payment Systems Regulations, 2021 forbid a licensee from outsourcing three things without the central bank's written approval. Those are licensed services, the core operation of a payment system, and technical personnel. Offering cross-border payment services needs separate written approval. The same Regulations set no rule about where data is stored. They point back to the general privacy law instead. TELECOMS: a copy must stay in the country The communications regulator attached licence conditions in May 2026. They require a national gateway with a physical point of presence in Uganda. Ugandan users' traffic must route through local infrastructure. GOVERNMENT: a copy must stay in the country Public bodies must link their databases into a national data bank managed by the state IT agency inside Uganda. INSURANCE, SECURITIES, HEALTH, EDUCATION, GAMBLING AND MAPPING: we found no storage or transfer rule beyond the general law. Checked 18 August 2026, confidence medium. See the unconfirmed list.

The model is your own assessment of the destination, with consent as a fallback. There is no list of banned countries and no list of approved ones. Nothing has been published either way, so there is nothing to check against. The regulator's portal carries a standing notice. It says cross-border transfers need an assessment of how well the destination country protects data, or the consent of the person the data is about. The portal also runs a Cross-border Transfer Impact Assessment module. You upload the destination organisation's approved data protection policy and approved information security policy. A cross-border score also feeds the annual compliance report required by regulation 50 of the Data Protection and Privacy Regulations 2021. So the paperwork is real, even though there is no approval step.

The Office was created under the Data Protection and Privacy Act. It operates under the National Information Technology Authority - Uganda. It is headed by a National Personal Data Protection Director. It works from the 7th Floor, Padre Pio House, Plot 32 Lumumba Avenue, Kampala. Its portal handles registration, annual compliance reporting, breach reporting, complaints, cross-border transfer assessments and audits. Its complaint workflow includes a formal status of 'Escalated to CID'. That is the Uganda Police Criminal Investigations Directorate. That is the enforcement route. Section 32 lets the Authority direct an organisation to put a breach right. Section 33 gives the person the data is about a right to sue for compensation in court. Punishment is reserved to criminal prosecution under sections 35 to 38. There is no power to impose administrative fines. Appeals against the Authority's decisions go to the Minister, not to a court or tribunal. We rate it 'waking' rather than 'active'. The office is fully staffed and operating, but we could find no published enforcement decision. Industry regulators are separately and clearly active. Those are the central bank, the communications regulator and the insurance regulator.

Section 18 of the Data Protection and Privacy Act sets the maximum, and its own exceptions. You may keep data beyond need where keeping it 'is required or authorised by law'. Also where it is necessary for a lawful purpose related to the activity. Also where a contract between the parties requires it. Or where the person the data is about consents. Destruction must be done so the record cannot be rebuilt in a readable form. Section 45(5) of the Financial Institutions Act, Cap. 57 sets the banking minimum at not less than ten years. Section 45(3) requires those records to be kept in Uganda. 'Financial records' is defined to include any computer record. So for a bank the clash resolves cleanly in favour of the ten-year minimum. We did not verify general company and tax record-keeping periods for this record. See the unconfirmed list.

Section 23 of the Act covers anyone who collects, handles or controls data. You must 'immediately notify the Authority in the prescribed manner' if you believe someone has accessed or acquired personal data without permission. You report the unauthorised access and the action you took to fix it. The Authority then decides whether the people affected should be told. If they must be told, there are four ways to do it. Registered mail, email, a prominent notice on your website, or publication in the mass media. The Updated National Information Security Framework 2026 states the deadline as 72 hours. The Minister of ICT and National Guidance launched it on 15 July 2026. Treat 'immediately' as the instruction to follow, and 72 hours as the outer limit. The regulator runs a dedicated breach reporting workflow and a breach reporting mailbox.

SENSITIVE DATA. Section 9 bans collecting or using data about religious or philosophical beliefs, political opinion, sexual life, financial information, health status or medical records. Narrow exceptions apply. They include free and informed consent, and an employer's legal duties. CHILDREN. Section 8 requires the parent's or guardian's consent in advance. The exceptions are where the law requires the data to be used, or where it is for research or statistical purposes. Uganda treats a child as a person under 18. CRIMINAL EXPOSURE. Section 35 covers unlawfully obtaining or disclosing personal data. It carries a fine of up to 240 currency points, or ten years in prison, or both. Section 36 covers unlawful destruction, deletion, concealment or alteration. It carries a fine of not less than 240 currency points, or up to ten years. Section 37 covers selling personal data, with up to 245 currency points or ten years. A currency point is 20,000 Uganda shillings. So 240 currency points is about 4.8 million shillings, roughly 1,300 US dollars. That is very small. The real risk is the prison term, and section 38. Under section 38 the company and every officer who knowingly and wilfully authorises or permits the breach commits the offence. The court may also fine the company up to two percent of its annual gross turnover. The regulator's own complaint system has a status of 'Escalated to CID'. That confirms criminal referral is a live route, not a theoretical one.

POWERS ALREADY HELD, TO WATCH. First, licence conditions. The Uganda Communications Commission imposed a national gateway and local traffic-routing requirement on Starlink. It did that through licence terms, not through published regulations. It can repeat that for any licensee at any time. Second, section 39 of the Data Protection and Privacy Act. After consulting the Authority, the Minister may make regulations on any prescribed matter. That expressly includes 'the retention period of personal data'. A national retention rule could appear without a new act of Parliament. Third, section 40 lets the Minister amend the Schedule with Cabinet approval. The Schedule sets the currency point at 20,000 shillings. Multiplying that figure multiplies every fine in the Act overnight. Fourth, regulation 3 of the National Data Bank Regulations. It lets the state IT agency prescribe how every public body links its database into the national data bank. That is a standing power over public sector systems. Fifth, the National Payment Systems Regulations give the central bank thirty days to approve any outsourcing by a payments licensee. RECURRING CALENDAR ITEMS: annual registration renewal with the regulator, and the annual compliance report under regulation 50 of the 2021 Regulations. If the report is queried, you have 14 days to file a remedial action plan.