Every business in Uganda collects personal data, often without thinking about it. A clinic records patient names and phone numbers. A SACCO keeps member ID details. A school stores information about children and parents. An online shop collects delivery addresses and Mobile Money numbers. Data protection law in Uganda sets out how this information must be collected, used, stored and shared. This article explains the main ideas in plain language so you can understand your duties and take practical steps. It is a general guide, not legal advice, so for your specific situation please consult a qualified lawyer or the official regulator.
The main law: the Data Protection and Privacy Act
Uganda's key data protection law is the Data Protection and Privacy Act, 2019, supported by the Data Protection and Privacy Regulations, 2021. The law is overseen by the Personal Data Protection Office (PDPO), which operates under the National Information Technology Authority, Uganda (NITA-U). The PDPO handles registration, complaints and guidance, and its website is the best place to find current forms and requirements.
The Constitution of Uganda also recognises the right to privacy, and the Act gives that right practical shape for the digital age.
Who does the law apply to?
The Act applies broadly to people and organisations that collect, hold or use personal data in Uganda, as well as to some outside Uganda who handle data about people in Uganda. It uses a few important terms:
- Data subject: the person the data is about, for example a customer, patient, student or employee.
- Data controller: the organisation that decides why and how data is used, for example your business.
- Data processor: someone who handles data on behalf of a controller, for example a payroll company or a hosting provider.
- Data collector: a person or organisation that collects personal data.
In practice, almost every business, NGO, school, church and government body that keeps records about people falls within the law.
What counts as personal data?
Personal data is any information that can identify a person. Common examples include names, phone numbers, email addresses, national ID numbers, photos, location data, and account numbers. The law also identifies special categories that need extra care, such as information about health, religious or philosophical beliefs, political opinions, sexual life and financial information. If you handle these, you should have stronger safeguards.
The core principles in plain language
The Act sets out principles that data controllers should follow. Put simply:
- Be accountable. You are responsible for the data you collect, even when someone else processes it for you.
- Be lawful and fair. Have a valid reason, such as consent or a legal obligation, for collecting data.
- Collect only what you need. Do not ask for a national ID copy just to sign someone up for a newsletter.
- Use it for the stated purpose. Data collected for deliveries should not be sold to marketers.
- Keep it accurate. Let people update their details.
- Do not keep it forever. Keep data only as long as needed, then delete it securely.
- Keep it secure. Protect it from loss, theft and unauthorised access.
- Be transparent. Tell people what you collect and why.
Consent and children
Consent is one of the main legal grounds for collecting data. Good consent is clear and specific: the person knows what they are agreeing to. Hidden pre ticked boxes or vague wording are poor practice. The law gives special protection to children, and data about children generally requires the consent of a parent or guardian. Schools, children's charities and youth programmes should pay close attention to this.
Rights of individuals
People whose data you hold have rights under the Act, including the right to:
- Know whether you hold their data and access it.
- Ask you to correct or delete inaccurate data.
- Object to certain uses of their data, such as direct marketing.
- Complain to the PDPO if they believe their rights have been violated.
Make sure your team knows what to do when a customer asks, "What information do you have about me?"
Registration with the PDPO
The law requires data collectors, processors and controllers to register with the Personal Data Protection Office. Registration is done through the PDPO's online system, and there may be fees depending on the type of organisation. Requirements and fees can change, so check the PDPO website for current details before applying.
Data breaches
A data breach happens when personal data is lost, stolen or accessed without permission. Examples include a hacked email account, a stolen unencrypted laptop, or a staff member sharing a customer list on WhatsApp. The law expects data controllers to notify the PDPO promptly when a breach occurs and, where needed, the affected people. Have a simple breach plan ready: who investigates, who informs the regulator, and how you contain the damage.
Practical compliance checklist for small businesses
- List what personal data you collect, where it is stored and who can access it.
- Remove data you do not need, and stop collecting it.
- Write a clear privacy notice and publish it on your website.
- Add consent wording to forms, including website contact forms.
- Use strong passwords and two step verification on systems holding personal data.
- Choose hosting and software providers with good security and backups.
- Sign data processing agreements with suppliers who handle your data.
- Register with the PDPO.
- Train staff on handling customer information and spotting phishing.
- Prepare a breach response plan.
Frequently asked questions
Does the data protection law apply to small businesses?
Generally, yes. The Act does not exempt businesses simply because they are small. A salon that keeps client phone numbers is collecting personal data.
What happens if a business breaks the law?
The Act provides for offences and penalties, which can include fines and in some cases imprisonment, and the PDPO can investigate complaints. Beyond legal penalties, a breach can seriously damage customer trust.
Can I store customer data on servers outside Uganda?
The Act has provisions on processing and storing personal data outside Uganda, which generally require adequate protection in the other country or the consent of the person. Get legal advice if you rely heavily on foreign storage.
Do I need a privacy policy on my website?
If your website collects any personal data, such as through forms, newsletters or online orders, a clear privacy notice is strongly recommended and supports the transparency principle.
Conclusion
Data protection law in Uganda is about respect: collect only what you need, keep it safe, use it honestly and let people control their own information. Start with the checklist, register with the PDPO and build good habits in your team. If you need secure hosting with daily backups, SSL and help adding a privacy notice to your website, the Baasa Cloud team can help.