Data protection in Uganda.

The Data Protection and Privacy Act, 2019 (Act 9 of 2019) regulates the collection and processing of personal data in Uganda. The Personal Data Protection Office (PDPO) enforces it, and every data collector, processor and controller must register.

Get started Check your readiness

In force: May 2019
Regulator: PDPO
Breach notice: Immediately

Supported via Kenya Hub

Kampala

At a glance

Uganda, in seven lines.

Law: Data Protection and Privacy Act, 2019 (Act 9 of 2019)
In force: 3 May 2019; regulations from 12 March 2021
Regulator: Personal Data Protection Office (PDPO), under NITA-U
Registration: Every data collector, processor and controller registers with the PDPO, including those abroad handling the data of people in Uganda
Data protection officer: The head of an institution must designate a DPO (section 6)
Breach notification: Immediately, to the PDPO (section 23; Regulation 33)
Penalties: Fines of up to about UGX 4.8 million and/or up to 10 years' imprisonment for listed offences; failing to register is an offence

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Key obligations

What the law asks of you.

Four obligations organisations in Uganda meet first, and where we help with each.

Register with the PDPO

Every data collector, data processor and data controller registers, including those outside Uganda processing the data of people in Uganda.

DPO360 helps with

Registration and licensing filings with national data protection authorities

Designate a Data Protection Officer

The head of an institution designates a DPO responsible for ensuring compliance.

DPO360 helps with

Formal DPO appointment and mandate definition, where permitted by law

Notify security breaches immediately

Where there is reason to believe personal data has been accessed or acquired by an unauthorised person, notify the PDPO immediately and report the remedial action taken.

DPO360 helps with

Incident and breach logging, escalation and regulator notification

Data processed abroad

Personal data processed or stored outside Uganda needs adequate protection or the data subject's consent.

DPO360 helps with

Cross-border data transfer governance: legal basis, safeguards and approvals

How the framework came together

From the law to the regulator.

3 May 2019
The Act commences
The Data Protection and Privacy Act, 2019 comes into operation.
March to August 2021
Regulations and the PDPO
The Data Protection and Privacy Regulations take effect on 12 March 2021, and the Personal Data Protection Office, under NITA-U, becomes operational in August 2021.
July 2025
First conviction
Uganda records its first conviction under the Act, showing it is being actively enforced.

PDPO

Regulatory authority

Personal Data Protection Office (PDPO)

An independent office under the National Information Technology Authority (NITA-U), mandated to regulate the collecting and processing of personal data in Uganda.

Mr. Baker Birikujja, National Director

Visit the website

What the PDPO does

Keeps the data protection register
Registers every collector, processor and controller, and the purpose of processing.
Handles complaints
Receives complaints about breaches of and non-compliance with the Act.
Oversees compliance
Oversees compliance and investigations under the Act.

Penalties

What non-compliance can cost.

Serious offences

UGX 4.8M

up to, or 10 years' imprisonment

Unlawfully obtaining or disclosing, destroying or altering, or selling personal data carries a fine of up to 240 to 245 currency points (about UGX 4.8 million) or up to 10 years' imprisonment, or both.

Registration and officers

3 months

up to, imprisonment for failing to register

Failing to register or renew is an offence, punishable by a fine or up to three months' imprisonment. Officers who knowingly authorise a corporation's offence commit it too.

Readiness check

Where do you stand?

Tick what is already in place. A quick read on where you stand in Uganda, for orientation only.

0/6

Plenty to tighten.

A short scoping call will map the gaps and the order to close them.

Close the gaps with us

We are registered with the PDPO, and our registration is current.Registration must be renewed.
A Data Protection Officer is designated.The head of the institution designates a DPO.
We can notify security breaches as soon as practicable.Prepare the process before an incident.
Data processed or stored outside Uganda has adequate protection.Or the data subject has consented.
Our privacy notices explain why we collect personal data.Collection must have a stated purpose.
Our policies and records of processing are documented.Documentation makes every other item easier to evidence.

Compare

Eight countries at a glance.

Tap a country to highlight its column. Scroll sideways for the rest.


Law	Protection of Personal Information Act (POPIA)	Data Protection Act, 2019	Nigeria Data Protection Act (NDPA), 2023	Data Protection and Privacy Act, 2019	Personal Data Protection Act, 2022	Law No. 058/2021	Data Protection Act, 2021	Data Protection Act, 2024
In force	July 2021 (most provisions from July 2020)	November 2019	June 2023	May 2019 (regulations March 2021)	May 2023	October 2021 (full compliance October 2023)	April 2021	June 2024
Regulator	Information Regulator	Office of the Data Protection Commissioner (ODPC)	Nigeria Data Protection Commission (NDPC)	Personal Data Protection Office (PDPO)	Personal Data Protection Commission (PDPC)	National Cyber Security Authority (NCSA)	Office of the Data Protection Commissioner	Malawi Communications Regulatory Authority (MACRA)
Registration	Register your Information Officer with the Regulator	Mandatory above thresholds, and in certain sectors, with the ODPC	Controllers and processors of major importance register with the NDPC	Every data collector, processor and controller registers with the PDPO	Collectors and processors register with the PDPC	Controllers and processors register with the NCSA	No one may act as a controller or processor without registering	Controllers and processors of significant importance register with MACRA
Data protection officer	Information Officer required for every organisation	May be designated; relevant for public bodies, large-scale monitoring and sensitive data	Mandatory for controllers of major importance	A DPO must be designated by the head of the institution	A DPO must be appointed	Required in certain cases (large-scale monitoring or sensitive data)	A DPO must be appointed, under the Commissioner's guidelines	Required for public authorities, and for large-scale monitoring or sensitive data
Breach notification	As soon as reasonably possible, to the Regulator and data subjects	Within 72 hours to the ODPC; data subjects within a reasonably practical period	Within 72 hours to the NDPC; data subjects immediately where high risk	Immediately, to the PDPO	Promptly, to the PDPC	Within 48 hours to the NCSA	Within 24 hours to the Commissioner; data subjects as soon as practicable	Within 72 hours to MACRA
Penalties	Administrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offences	Up to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 years	Major importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2%	Up to about UGX 4.8 million and/or 10 years for listed offences	Penalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 years	Administrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnover	Corporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 years	Administrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years
	Open briefing →	Open briefing →	Open briefing →		Open briefing →	Open briefing →	Open briefing →	Open briefing →

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Reviewed October 2026 against: Data Protection and Privacy Act, 2019 (sections 6, 19, 23 and 35 to 38) and the Data Protection and Privacy Regulations, 2021.

Additional resources

Read the source documents.

Personal Data Protection OfficeRegulator website Data Protection and Privacy Act 2019Legislation

Supported through

Kenya Hub

East, Central & Southern Africa

DPO360 in Uganda

How we support organisations in Uganda.

Uganda is supported through our Kenya hub, which covers East, Central & Southern Africa, with delivery coordinated from our Nairobi headquarters.

Registration and licensing filings with the national authority
Breach logging, escalation and regulator notification
Consent, policy and records-of-processing frameworks
Data mapping, including where data is processed
Data subject access request management
A standing DPO appointment, with DPO-as-a-Service

2nd Floor 90 JGO, James Gichuru Road, Lavington

P.O Box 40583-00100 Nairobi, Kenya

+254735360360 | +447394407463

Ready to Make Privacy Your Advantage?

Speak to our team about compliance in Uganda and beyond.

Book a consultation DPO-as-a-Service

Data protection in Uganda.

Uganda, in seven lines.

What the law asks of you.

Register with the PDPO

Designate a Data Protection Officer

Notify security breaches immediately

Data processed abroad

From the law to the regulator.

The Act commences

Regulations and the PDPO

First conviction

Personal Data Protection Office (PDPO)

Keeps the data protection register

Handles complaints

Oversees compliance

What non-compliance can cost.

Where do you stand?

Eight countries at a glance.

Read the source documents.

How we support organisations in Uganda.

Ready to Make Privacy Your Advantage?