Data protection compliance in Uganda
Launching in or expanding to Uganda? The Data Protection and Privacy Act applies to you. We help you register with the PDPO and build compliance into your product.
Key facts
- Main law
- Data Protection and Privacy Act, 2019, and the Data Protection and Privacy Regulations, 2021
- Regulator
- Personal Data Protection Office (PDPO), under NITA-U
- Registration
- Organisations that collect, process, control or store personal data must register with the PDPO.
- Breach notification
- Notify the PDPO promptly after a data breach, and take steps to contain it.
- Penalties
- Offences under the Act can lead to fines and, in some cases, imprisonment of responsible officers.
General information, last reviewed October 2026. Laws and regulator practice change, so confirm specifics with our team. This is not legal advice.
What you need to do
- Register with the PDPO before processing personal data
- Collect personal data with consent or another lawful basis, and only for a clear purpose
- Keep personal data accurate, secure and no longer than necessary
- Respect data subject rights, including access and correction
- Only transfer data outside Uganda where adequate protection is in place
- Appoint a responsible person for data protection in your organisation
Compliance in Uganda, handled
Registration
We prepare and submit your registration with the regulator.
Gap assessment
We review your product and operations against the law and give you a clear fix list.
Implementation
We fix the gaps in your policies, processes and code, including consent, audit logs and access control.
Outsourced DPO
We act as your Data Protection Officer on a monthly retainer.
Operating in more than one country? See our guides for Kenya, Tanzania, Rwanda, or read our East Africa expansion checklist.
Ready to talk?
Book a free 30-minute consultation. Tell us what you're building and we'll tell you what to fix first.