Data protection & privacy law in Uganda (2026)
Data protection in Uganda: comprehensive law.
Uganda enacted a comprehensive personal data protection regime through the Data Protection and Privacy Act (DPPA) of 2019, which came into force on 3 May 2019, and supplemented it with detailed implementing Regulations in March 2021. The PDPO, an independent office under NITA-U, serves as the national supervisory authority with powers to investigate, enforce, and impose penalties. The regime applies to all entities handling personal data of Ugandan citizens, including foreign-based entities, as reaffirmed by the PDPO in enforcement actions taken in 2025.
Legal framework
Data Protection and Privacy Act, 2019 (Act No. 9 of 2019) and Data Protection and Privacy Regulations, 2021 (SI No. 21 of 2021); supervised by the Personal Data Protection Office (PDPO) operating under the National Information Technology Authority, Uganda (NITA-U)
Key points: data & privacy in Uganda
Primary Legislation
The Data Protection and Privacy Act No. 9 of 2019 (in force 3 May 2019) is Uganda's overarching data protection statute, regulating collection, processing, storage, use, and disclosure of personal data by data collectors, processors, and controllers in both the public and private sectors.
Implementing Regulations
The Data Protection and Privacy Regulations, 2021 (SI No. 21 of 2021, effective 12 March 2021) detail operational requirements including PDPO management procedures, data controller and processor registration, cross-border transfer safeguards, and enforcement procedures.
Supervisory Authority
The Personal Data Protection Office (PDPO), headquartered at NITA-U, is the independent national supervisory authority. It registers data controllers and processors, investigates complaints, and issues binding enforcement decisions. The PDPO has shown active enforcement since 2025, including a ruling against Google LLC in July 2025 for operating without registration.
Registration Obligation
All data collectors, processors, and controllers, whether domestic or foreign, must register with the PDPO and renew annually (fee: UGX 100,000 ≈ USD 30). Failure to register is punishable by fine or up to three months' imprisonment. In August 2025 the PDPO formally clarified that this obligation extends to offshore entities handling Ugandan citizens' data.
Data Subject Rights
Individuals hold rights to access, rectification, erasure, and objection to processing of their personal data. Data subjects may also request the identity of third parties who have accessed their data and the legal basis for its collection and processing.
Cross-Border Transfers & Penalties
Transfers of personal data outside Uganda require the destination country to provide equivalent protection, or data subject consent. Entities must maintain records of the legal basis for transfers but do not need advance PDPO approval per transfer. Penalties for serious violations reach UGX 4.8 million (≈ USD 1,300), up to 10 years' imprisonment, or fines of up to 2% of annual gross turnover.
Sources
- ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03
- ict.go.ug/wp-content/uploads/2019/03/Data-Protection-and-Privacy-Act-2019.pdf
- pdpo.go.ug/media/2022/03/Data_Protection_and_Privacy_Regulations-2021.pdf
- ulii.org/akn/ug/act/si/2021/21/eng@2021-03-12
- pdpo.go.ug/
- cipesa.org/2025/07/ugandan-regulator-finds-google-in-breach-of-countrys-data-pro
- privacymatters.dlapiper.com/2025/08/uganda-data-protection-regulator-clarifies-compliance-require
- lexafrica.com/2025/09/uganda-data-protection-conviction-digital-privacy-enforcement
- pdpo.go.ug/media/2022/01/20102021105143-Registration_Classification_and_Guidance
- securiti.ai/uganda-data-protection-and-privacy-act/
Next for Uganda: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026