Uganda: technology regulation at a glance

Framework: Anti-Money Laundering Act 2013 (amended December 2020), VASPs register with Financial Intelligence Authority; Bank of Uganda Circular NPSD 306 (2022) banning crypto-to-mobile-money conversions; National Payment Systems Act 2020; Capital Markets Authority regulatory sandbox; no comprehensive dedicated virtual-assets law in force

Uganda lacks a dedicated virtual-assets law: the 2020 AML Act amendment subjects VASPs to Financial Intelligence Authority oversight for AML/CFT purposes, while a 2023 High Court ruling (Kayondo v Bank of Uganda, Misc Cause No. 109 of 2022) confirmed cryptocurrency is illegal as a payment instrument under the National Payment Systems Act. The Bank of Uganda and Capital Markets Authority operate a joint regulatory sandbox, the BoU Governor publicly outlined six regulatory pillars in 2025, and a private member's bill to regulate virtual assets via a Capital Markets Authority Act amendment is before Parliament, signalling active but still-incomplete framework-building.

Framework: National AI and Emerging Technologies Strategy (in development, 2025-2026), led by the Ministry of ICT & National Guidance; Data Protection and Privacy Act No. 9 of 2019 as primary applicable law; NITA-U as IT regulatory authority

Uganda has no dedicated AI law in force as of May 2026. The government is developing a National AI and Emerging Technologies Strategy under a Cabinet directive, led by the Ministry of ICT & National Guidance with an 11-member National AI Task Force guiding the process. In the interim, AI-relevant data governance is covered by the Data Protection and Privacy Act 2019, while stakeholder consultations and a UNESCO AI Readiness Assessment process (launched February 2026) are shaping the forthcoming framework.

Framework: Data Protection and Privacy Act, 2019 (Act No. 9 of 2019) and Data Protection and Privacy Regulations, 2021 (SI No. 21 of 2021); supervised by the Personal Data Protection Office (PDPO) operating under the National Information Technology Authority, Uganda (NITA-U)

Uganda enacted a comprehensive personal data protection regime through the Data Protection and Privacy Act (DPPA) of 2019, which came into force on 3 May 2019, and supplemented it with detailed implementing Regulations in March 2021. The PDPO, an independent office under NITA-U, serves as the national supervisory authority with powers to investigate, enforce, and impose penalties. The regime applies to all entities handling personal data of Ugandan citizens, including foreign-based entities, as reaffirmed by the PDPO in enforcement actions taken in 2025.

Framework: National Payment Systems Act 2020 (Act No. 15 of 2020) and National Payment Systems Regulations 2021, regulated by the Bank of Uganda (BoU)

Uganda established a comprehensive payment systems licensing regime through the National Payment Systems Act 2020 (assented July 29, 2020) and the NPS Regulations 2021, with the Bank of Uganda as the sole regulator. The framework covers three license classes, payment system operators, payment service providers (including e-money issuers), and issuers of payment instruments, replacing prior informal mobile-money 'no-objection' arrangements. Uganda further guides sector development through a National E-Payments Strategy 2021-2026 and a dedicated NPS Oversight Framework 2025.

Framework: Uganda Citizenship and Immigration Control Act (Cap. 66), administered by the Directorate of Citizenship and Immigration Control (DCIC) under the Ministry of Internal Affairs

Uganda has no dedicated digital nomad or remote-work visa. Remote workers may enter on a tourist visa (up to 90 days) but that visa explicitly prohibits any form of work; the previously used Special Pass has been informally discontinued and applicants are redirected to the employer-sponsored Entry Permit Class G2. Independent remote workers have no clearly designated, sponsored-free legal pathway; a Retirement Permit offers a route for those aged 60 and above with sufficient offshore income.

Framework: Uganda Communications Commission (UCC) under the Uganda Communications Act; Computer Misuse Act 2011 (amended 2022); Data Protection and Privacy Act 2019

Uganda enforces internet and online content controls through a combination of broadly worded criminal statutes, an active regulatory authority empowered to order shutdowns, and state-directed censorship of online speech. The government conducted a blanket internet shutdown ahead of the January 2026 general elections and is actively acquiring surveillance technology to filter social media, placing Uganda firmly in a heavy-restriction regime rather than a user-safety-oriented framework.

Framework: Computer Misuse Act 2011 (amended 2022/2023) + Data Protection and Privacy Act 2019, with sector-specific rules from Bank of Uganda (Dec 2024) and Uganda Communications Commission (June 2025); NITA-U administers the National Information Security Framework and National Cybersecurity Strategy 2022-2026

Uganda's cybersecurity regime is built around a general cybercrime statute (Computer Misuse Act 2011, last revised 2023) and a data protection law with breach-notification duties (DPPA 2019), supplemented by binding sector rules for finance (Bank of Uganda, effective December 2024) and telecommunications (UCC, June 2025). No single cross-sector comprehensive cybersecurity law analogous to the EU's NIS2 is in force; instead, NITA-U coordinates national cybersecurity through the National Cybersecurity Strategy 2022-2026 and operates the national CERT (CERT.UG). Mandatory incident-reporting obligations exist under the DPPA and the BoU directives, but remain sector-limited rather than economy-wide.

Framework: Companies Act 2012 (Cap. 110); Uganda Investment Code Act 2019; Uganda Registration Services Bureau Act 1998, administered by the Uganda Registration Services Bureau (URSB) and the Uganda Investment Authority (UIA)

Uganda permits 100% foreign ownership in most sectors and offers a fully online company registration portal (OBRS) through URSB, with incorporation achievable in 3-5 working days and no minimum share capital for private companies. However, foreign investors are additionally required to obtain a UIA Investment License with a minimum capital threshold of USD 250,000, adding a layer not required of domestic investors. Sector-specific restrictions apply in areas such as telecommunications, financial services, media, and land ownership.