Regulations › Rest of world › Uganda
DPPA (Uganda)
Data Protection and Privacy Act, 2019 (Uganda)
WhenIn effect since 3 May 2019
Who enforces itPersonal Data Protection Office (PDPO)
Who it applies toInstitutions, collectors, processors and controllers handling personal data in Uganda.
Tell the regulatorNotify the PDPO immediately on believing data was accessed or acquired by an unauthorized person
DPO requiredThe head of every institution covered by the Act must designate a data protection officer
RegistrationAll collectors, processors and controllers must register with the PDPO, renew annually and pay…
Transfers abroadProcessing or storage abroad requires adequate protection at least equivalent to the Act, or d…
Request deadline30 days for access requests
Maximum fineCourts may fine a corporation up to 2% of annual gross turnover
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies to anyone collecting or processing personal data in Uganda, and to anyone outside Uganda handling data relating to Ugandan citizens.s.1 · source ↗
PDPO applied this to offshore entities in Ssekamwa & 3 others v Google LLC (18 July 2025).
Lawful basis
3
Prior consent is the default; exceptions cover law, national security, medical purposes, legal obligation and contracts. No legitimate interests ground.s.7(1)-(2) · source ↗
Consent
2
Consent must be a freely given, specific, informed and unambiguous indication of the data subject's wishes.s.2 (definition); s.7 · source ↗
Sensitive data
2
Special personal data (beliefs, politics, sexual life, financial, health) may be processed only under listed exceptions, such as freely given consent.s.9 · source ↗
Children
3
Age 18. Processing a child's data needs prior parental or guardian consent, unless required by law or for research or statistics.s.8; Reg. 11 · source ↗
The Act does not define child; 18 comes from the Children Act and Constitution Art. 257 (not re-read). Reg. 11 per secondary source.
People's rights
Rights
2
Access, correction and deletion, objection to damaging processing, direct marketing opt-out, and rights against solely automated decisions.ss.16, 24-27 · source ↗
No portability or restriction right.
Request deadline
2
30 days for access requests; 14 days to answer objections and direct marketing notices.s.24(9); ss.25(2), 26(2) · source ↗
Marketing
1
Data subjects may require a controller to stop direct marketing processing; the controller must respond within 14 days.s.26 · source ↗
Governance
DPO required
3
The head of every institution covered by the Act must designate a data protection officer.s.6 · source ↗
Regulations reportedly let the PDPO specify which entities must designate (reg. 47); list not published.
Registration
3
All collectors, processors and controllers must register with the PDPO, renew annually and pay fees (UGX 100,000 reported).s.29; Reg. 13 or 15(1) · source ↗
Annual renewal and fees come from the Google decision as reported by DLA Piper; regulation number disputed.
DPIA
2
A data protection impact assessment is required before collecting or processing high-risk personal data.Reg. 12, Data Protection and Privacy Regulations 2021 · secondary source · source ↗
Regulation text not read directly; another firm describes Reg. 12(1) as a risk assessment duty.
Records
1
No general record of processing duty; the PDPO register records each entity's processing purpose, and registered entities file annual compliance reports.s.29 · source ↗
Annual compliance report reported by law firms, not seen in Act text.
Retention
2
Data may not be kept longer than necessary; at expiry it must be destroyed, deleted or de-identified.s.18(1), (4) · source ↗
Breaches
Tell the regulator
3
Notify the PDPO immediately on believing data was accessed or acquired by an unauthorized person.s.23(1); Reg. 33 · source ↗
Tell people
1
Data subjects are notified only if the PDPO decides they should be.s.23(2)-(3) · source ↗
Transfers
Transfers abroad
2
Processing or storage abroad requires adequate protection at least equivalent to the Act, or data subject consent; onward transfer needs express consent.s.19; Reg. 30(2) · source ↗
PDPO adequacy list not yet published.
Enforcement
Maximum fine
3
Courts may fine a corporation up to 2% of annual gross turnover; individual offenses up to 245 currency points (UGX 4.9 million).ss.35-38 · source ↗
Criminal fines imposed by a court, not administrative fines. Turnover basis is not stated as global.
Criminal liability
2
Unlawful obtaining, disclosure, destruction or sale of personal data carries up to 10 years' imprisonment; regulations add offenses such as failure to register.ss.35-37; Regs 15(1), 30(6), 34(1) · source ↗
First conviction of a company director for non-registration in July 2025.
Private action
2
A data subject who suffers damage or distress may apply to court for compensation; complaints also go to the PDPO.ss.31, 33 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws