Regulations › Rest of world › Uganda
DPPA (Uganda)
Data Protection and Privacy Act, 2019 (Uganda)
WhenIn effect since 3 May 2019
Who enforces itPersonal Data Protection Office (PDPO)
Who it applies toInstitutions, collectors, processors and controllers handling personal data in Uganda.
Tell the regulatorNotify the PDPO immediately on believing data was accessed or acquired by an unauthorized person
DPO requiredThe head of every institution covered by the Act must designate a data protection officer
RegistrationAll collectors, processors and controllers must register with the PDPO, renew annually and pay…
Transfers abroadProcessing or storage abroad requires adequate protection at least equivalent to the Act, or d…
Request deadline30 days for access requests
Maximum fineCourts may fine a corporation up to 2% of annual gross turnover
62%
of Uganda's 21 requirements are already met by European Union (GDPR). Here is what DPPA (Uganda) adds, biggest gaps first.
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
DPPA (Uganda) adds3 All collectors, processors and controllers must register with the PDPO, renew annually and pay fees (UGX 100,000 reported).
s.29; Reg. 13 or 15(1) · source ↗
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
DPPA (Uganda) adds3 Prior consent is the default; exceptions cover law, national security, medical purposes, legal obligation and contracts. No legitimate interests ground.
s.7(1)-(2) · source ↗
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
DPPA (Uganda) adds3 The head of every institution covered by the Act must designate a data protection officer.
s.6 · source ↗
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
DPPA (Uganda) adds3 Applies to anyone collecting or processing personal data in Uganda, and to anyone outside Uganda handling data relating to Ugandan citizens.
s.1 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
DPPA (Uganda) adds3 Age 18. Processing a child's data needs prior parental or guardian consent, unless required by law or for research or statistics.
s.8; Reg. 11 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
DPPA (Uganda) adds2 Data may not be kept longer than necessary; at expiry it must be destroyed, deleted or de-identified.
s.18(1), (4) · source ↗
Tell the regulatorBreachesGap
GDPR2 Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
DPPA (Uganda) adds3 Notify the PDPO immediately on believing data was accessed or acquired by an unauthorized person.
s.23(1); Reg. 33 · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
DPPA (Uganda) adds2 Unlawful obtaining, disclosure, destruction or sale of personal data carries up to 10 years' imprisonment; regulations add offenses such as failure to register.
ss.35-37; Regs 15(1), 30(6), 34(1) · source ↗
Already covered by GDPR: Consent, Sensitive data, Rights, Request deadline, Marketing, DPO qualifications, DPIA, Records, Tell people, Transfers abroad, Localization, Maximum fine, Private action.
A gap means DPPA (Uganda) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws