Uganda
ModerateData Protection and Privacy Act 2019
Authority: National Information Technology Authority (NITA-U) | Enforcement: partial | Enacted: June 2019
Overview
Uganda enacted the Data Protection and Privacy Act in 2019. NITA-U was designated as the supervisory authority. The law provides for data subject rights, consent, and cross-border transfer restrictions. Enforcement capacity is developing.
14-Topic Coverage
Data Protection Authority
Fully AddressedNITA-U oversees compliance and registration of data collectors.
Consent Requirements
Fully AddressedConsent required for collection and processing. Must be informed and voluntary.
Data Subject Rights
Fully AddressedRights to access, correction, and deletion.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with consent.
Breach Notification
Partially AddressedRegulations provide for breach notification. Practical implementation developing.
DPO Requirements
Partially AddressedData collectors must register with NITA-U.
Children's Data
Partially AddressedGeneral provisions apply. Children Act provides additional protections.
Penalties & Enforcement
Fully AddressedFines up to UGX 4.8 million and/or imprisonment up to 10 years.
Sector-Specific Rules
Partially AddressedBOU financial data rules, health data regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions.
Data Localisation
Partially AddressedSome government data localisation requirements.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedAct applies to government with national security exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Uganda's regulations.
Book a Consultation