Uganda

Section 1 of the Data Protection and Privacy Act (Act 9 of 2019, now consolidated as Cap. 97) applies the Act to a person, institution or public body '(a) collecting, processing, holding or using personal data within Uganda; (b) outside Uganda who collects, processes, holds, or uses personal data relating to Ugandan citizens.' Note the hook is citizenship, not residence — the Act does not use a targeting or 'offering goods and services' test the way Europe or India do. Sections 29 and 30 require the Authority to keep a data protection register covering every person, institution or public body collecting or processing personal data, and to make it open to public inspection. The regulator's own portal runs the registration, annual renewal, change-of-particulars and de-registration workflows. The Act does not itself require a named local representative, though the 2021 Regulations require a data protection officer.

Section 19 of the Act is the whole general rule and it is two lines long. Rated by sector: banking is a copy must stay in the country — the Financial Institutions Act, Cap. 57 requires a licensed institution's financial ledgers and records to be kept in Uganda, and non-financial records to be maintained within Uganda. Payments is data can leave with paperwork with a hard gate — the National Payment Systems Regulations, 2021 forbid a licensee from outsourcing licensed services, the core operation of a payment system, or technical personnel without the central bank's written approval, and forbid offering cross-border payment services without separate written approval; the same Regulations contain no storage-location rule and instead point back to the general privacy law. Telecoms is a copy must stay in the country in practice — the communications regulator attached licence conditions in May 2026 requiring a national gateway with a physical point of presence in Uganda and routing of Ugandan users' traffic through local infrastructure. Government is a copy must stay in the country — public bodies must link their databases into a national data bank managed by the state IT agency inside Uganda. For insurance, securities, health, education, gambling and mapping we found no localisation or transfer rule beyond the general law, checked 18 August 2026, confidence medium; see the unconfirmed list.

The statutory model is self-assessed adequacy with a consent fallback, not a blocklist or an allowlist. No list of adequate or prohibited destinations has been published, so there is nothing to check against. The regulator's portal carries a standing notice that 'Cross border data transfers require an adequacy assessment of the country to which you intend to transfer or consent of the data subject', and runs a Cross-border Transfer Impact Assessment module in which an organisation uploads the destination entity's approved data protection policy and approved information security policy. A cross-border score also feeds the annual compliance report required by regulation 50 of the Data Protection and Privacy Regulations 2021. Practically: the paperwork burden is real even though the approval step is not.

The Office was established under the Data Protection and Privacy Act and operates under the National Information Technology Authority - Uganda, headed by a National Personal Data Protection Director, from the 7th Floor, Padre Pio House, Plot 32 Lumumba Avenue, Kampala. Its portal exposes registration, annual compliance reporting, breach reporting, complaints, cross-border transfer assessments and audits, and its complaint workflow includes a formal status 'Escalated to CID' — the Uganda Police Criminal Investigations Directorate. That is the enforcement route: the Act gives the Authority power under section 32 to direct a controller or processor to remedy a breach, gives data subjects a right under section 33 to sue for compensation in court, and reserves punishment to criminal prosecution under sections 35 to 38. There is no administrative fining power. Appeals against the Authority's decisions go to the Minister, not to a court or tribunal. Rated 'waking' rather than 'active' because the machinery is fully staffed and operating but we could locate no published enforcement decision. Sector regulators — the central bank, the communications regulator and the insurance regulator — are separately and clearly active.

Section 18 of the Data Protection and Privacy Act sets the ceiling and its own escape hatches: retention is permitted beyond need where it 'is required or authorised by law', is necessary for a lawful purpose related to the activity, is required by a contract between the parties, or the data subject consents. Destruction must be done so the record cannot be reconstructed in an intelligible form. Section 45(5) of the Financial Institutions Act, Cap. 57 sets the banking floor at not less than ten years, and section 45(3) requires those records to be kept in Uganda; 'financial records' is defined to include any computer record. So a bank's conflict resolves cleanly in favour of the ten-year floor. General company and tax record-keeping periods were not verified for this record — see the unconfirmed list.

Section 23 of the Act requires a data collector, processor or controller who believes personal data has been accessed or acquired by an unauthorised person to 'immediately notify the Authority in the prescribed manner' of the unauthorised access and the remedial action taken. The Authority then decides whether the individuals should be told, and if so the notification must go by registered mail, by email, by a prominent notice on the responsible party's website, or by publication in the mass media. The Updated National Information Security Framework 2026, launched by the Minister of ICT and National Guidance on 15 July 2026, states the deadline as 72 hours. Treat 'immediately' as the operative instruction and 72 hours as the outer limit. The regulator runs a dedicated breach reporting workflow and a breach reporting mailbox.

On sensitive data: section 9 bans collecting or processing data on religious or philosophical beliefs, political opinion, sexual life, financial information, health status or medical records, subject to narrow exceptions including free and informed consent and employer legal obligations. On children: section 8 requires prior parental or guardian consent unless the processing is required by law or is for research or statistical purposes; Uganda treats a child as a person under 18. On criminal exposure: section 35 (unlawfully obtaining or disclosing personal data) carries a fine of up to 240 currency points or ten years' imprisonment or both; section 36 (unlawful destruction, deletion, concealment or alteration) carries a fine of not less than 240 currency points or up to ten years; section 37 (selling personal data) carries up to 245 currency points or ten years. A currency point is 20,000 Uganda shillings, so 240 currency points is about 4.8 million shillings — roughly 1,300 US dollars, trivially small. The teeth are the prison term and section 38, under which the company and every officer who knowingly and wilfully authorises or permits the contravention commits the offence, and the court may additionally fine the company up to two percent of its annual gross turnover. The regulator's own complaint system contains a status 'Escalated to CID', confirming that criminal referral is a live pathway rather than a theoretical one.

Dormant switches to watch. First, licence conditions: the Uganda Communications Commission imposed a national gateway and local traffic-routing requirement on Starlink through licence terms, not through published regulations, and can repeat that for any licensee at any time. Second, section 39 of the Data Protection and Privacy Act empowers the Minister, after consulting the Authority, to make regulations by statutory instrument covering any prescribed matter and specifically 'the retention period of personal data' — a national retention mandate could appear without primary legislation. Third, section 40 lets the Minister amend the Schedule with Cabinet approval, and the Schedule sets the currency point at 20,000 shillings; multiplying that figure multiplies every fine in the Act overnight. Fourth, regulation 3 of the National Data Bank Regulations lets the state IT agency prescribe how every public body links its database into the national data bank, which is a standing power over public-sector architecture. Fifth, the National Payment Systems Regulations give the central bank a thirty-day approval discretion over any outsourcing by a payments licensee. Recurring calendar items: annual registration renewal with the regulator, and the annual compliance report under regulation 50 of the 2021 Regulations, after which you have 14 days to file a remedial action plan if the report is queried.