Uganda's Data Protection and Privacy Act: PDPO registration and breaches

Registration with the PDPO

The Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021 require every person, institution or public body collecting, processing, holding or using personal data to register with the Personal Data Protection Office, which sits within the National Information Technology Authority (NITA-U). Registration is made online and renewed periodically; note the expiry date on the certificate.

Breach notification

Section 23 requires a data collector, processor or controller that believes personal data has been accessed or acquired by an unauthorised person to notify the PDPO immediately, and the Office decides whether data subjects must be told. "Immediately" is stricter than a fixed period, so act within hours; hlola uses 72 hours only as the outer limit of its clock for Ugandan entities.

Other core duties

• Collect personal data with consent or another basis the Act allows, directly from the data subject where possible
• Designate a person responsible for data protection in the organisation
• Keep personal data secure, and use processors only under written contract
• Transfer data outside Uganda only where the recipient country gives adequate protection or the data subject consents
• Answer data subject requests within the periods the Regulations set

Penalties

Offences under the Act carry fines and imprisonment, and a corporation that commits an offence is liable to a fine of up to 2% of its gross annual turnover. See Uganda's DPPA in hlola.

Common questions