Uganda Data Protection and Privacy Act compliance, so your data handling holds up when someone asks.

What it is

What is Uganda's Data Protection and Privacy Act and what is it used for?

The Data Protection and Privacy Act, 2019 (Chapter 97 of the Laws of Uganda) is Uganda's general law on personal data, commenced on 3 May 2019. It applies to any person, institution or public body collecting, processing, holding or using personal data within Uganda, and to those outside Uganda who do so for personal data relating to Ugandan citizens. It requires consent or another lawful basis, a specific purpose and no more data than that purpose needs, notice before collection, restrictions on children's data and special personal data, which includes financial information, health status and medical records, a data protection officer in institutions, security measures, processor contracts, immediate breach reporting and safeguards for processing outside Uganda.

The Personal Data Protection Office, established by the Act under the National Information Technology Authority, Uganda, keeps the data protection register. Its portal asks collectors, processors and controllers to register and renew each year, to submit an impact assessment for new projects, products, systems or services that process personal data, to apply for approval before transferring data outside Uganda and to report breaches immediately. The practical test: for any personal data you hold, could you show your registration, its basis, who was told, how it is protected and where it goes?

Current law. The Data Protection and Privacy Act, 2019, cited by the Personal Data Protection Office as Cap. 97, was assented to on 25 February 2019 and commenced on 3 May 2019. Confirm current wording, the Regulations and the Office's guidance with your legal advisers.

Who it is for

Who needs to comply with the Uganda Data Protection and Privacy Act?

The Act applies to anyone collecting or processing personal data in Uganda, whatever their size, and to those outside Uganda processing data about Ugandan citizens. Organisations usually come to Sterling for a structured programme from one of four directions:

• You must be on the register. Section 29 has every person, institution or public body that collects or processes personal data entered on the data protection register, and the PDPO asks for annual renewal through its portal.
• You hold financial or health data. Financial information, health status and medical records are special personal data under the Act, which brings banks, lenders, insurers, clinics and laboratories firmly into scope.
• You process data for others. Processors work under contracts that require confidentiality and security, so clients ask for that evidence first.
• You host or send data abroad. Processing outside Uganda needs a receiving country that protects the data at least as well as the Act, or the person's consent, and the PDPO takes applications for transfer approval.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Uganda DPPA requirements?

Strip away the vocabulary and Uganda's Data Protection and Privacy Act requires a business to handle personal data in six disciplined ways. The list below puts each one in business terms; the Act and the regulator's guidance give the full wording and exceptions.

• Collect only with a lawful purpose: personal data is collected with consent or another lawful basis, for a specific, explicit purpose, and only as much as that purpose needs.
• Tell people before collecting: before collection, people learn what is collected, by whom, why, who receives it, how long it is kept and their right to access and correction.
• Register and appoint an owner: every collector, processor and controller is entered on the data protection register, and institutions designate a data protection officer responsible for compliance.
• Secure data and bind processors: foreseeable risks are identified, safeguards maintained and regularly verified, and processors work under contracts requiring confidentiality and security.
• Report breaches straight away: unauthorised access to personal data is reported to the Authority immediately with remedial steps, and affected people are told when the Authority directs.
• Honour rights and protect transfers: people can access, correct and stop processing, refuse direct marketing and challenge automated decisions; data goes abroad only with adequate protection or consent.

Compliance route

How do you achieve Uganda DPPA compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the Personal Data Protection Office if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, staff, patients, users and suppliers: what is collected, for which purpose, on which basis, where it is stored, who processes it for you, whether it is special personal data and whether it is processed outside Uganda.
2. 02
   Gap analysis: compare current practice with the Act.Each area of the Act reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Register or renew with the PDPO, rewrite notices and consent wording, designate the data protection officer, put security measures and processor contracts in place, prepare impact assessments for new projects and agree a breach procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents and report them immediately, renew the registration each year, review transfers and approvals, refresh training and follow the Office's guidance as it is issued.

Check the route before you sign. The Act creates no certificate of compliance, so treat any offer of a "DPPA certificate" with suspicion; entry on the register records registration, not compliance. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation scope directly with the accreditation body concerned.

Cost

How much does Uganda DPPA compliance cost?

The cost of a Uganda DPPA programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Uganda DPPA compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Uganda DPPA engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and the Act creates no certificate of compliance; the Personal Data Protection Office supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, consent wording, request, security, impact assessment and breach procedures, processor contract terms and transfer documents, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Registration and officer support

  Help preparing the registration and its renewal, the data protection officer designation and impact assessments for the PDPO, with findings closed with evidence.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Personal Data Protection Office, established by the Act under the National Information Technology Authority, Uganda, keeps the register, takes complaints and can carry out compliance audits.

Often combined with

Standards organisations pair with Data Protection and Privacy Act (Uganda)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.