Uganda · Compliance
Uganda Data Protection and Privacy Act, 2019 (Cap. 97) compliance in Uganda
Achieve Uganda Data Protection and Privacy Act, 2019 (Cap. 97) compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Nairobi office team
- Effivity software included
- Academy training included
Who asks for Uganda Data Protection and Privacy Act, 2019 (Cap. 97) in Uganda
Clients include
Uganda Data Protection and Privacy Act, 2019 (Cap. 97) compliance in Uganda at a glance
Data Protection and Privacy Act, 2019 (Data Protection and Privacy Act, Cap. 97) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Uganda ask for evidence that you meet it.
Registration with the Personal Data Protection Office is where most Ugandan privacy work starts, because the Data Protection and Privacy Act places every collector, processor and controller on a data protection register, renewed each year through the PDPO portal. The Act then asks for consent or another lawful basis, notice before collection, a designated data protection officer, appropriate security, processor contracts, immediate breach notification and safeguards before data is processed outside Uganda. Financial information, health status and medical records count as special personal data, which brings banks, lenders, clinics and insurers firmly into scope. The PDPO also takes impact assessments for new projects, transfer applications and complaints. No certificate proves compliance; evidence does, and ISO/IEC 27701 certification by an accredited body can support it. Sterling's Nairobi office runs the programme with clear owners for each duty, using Effivity to keep evidence current.
Who needs Uganda Data Protection and Privacy Act, 2019 (Cap. 97) in Uganda, and what happens without it
These are the organisations in Uganda that most often need to show Uganda Data Protection and Privacy Act, 2019 (Cap. 97).
- Any organisation that collects or uses personal data in UgandaThe Act applies to persons, institutions and public bodies collecting or processing personal data within Uganda and to those outside who process data relating to Ugandan citizens.
- Banks, insurers, lenders and payment providersFinancial information is special personal data under the Act, so collection needs a lawful basis such as consent or a legal obligation.
- Hospitals, clinics, laboratories and insurersHealth status and medical records are special personal data, which the Act restricts.
- Organisations hosting or processing data abroadProcessing outside Uganda needs adequate protection or consent, and the PDPO takes applications for transfer approval.
- Schools, apps and services used by childrenChildren's data needs parental or guardian consent unless the law or research purposes apply.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkUganda Data Protection and Privacy Act, 2019 (Cap. 97) requirements in Uganda
Strip away the vocabulary and Uganda's Data Protection and Privacy Act requires a business to handle personal data in six disciplined ways.
In Uganda these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Uganda Data Protection and Privacy Act, 2019 (Cap. 97) explained →
How to achieve Uganda Data Protection and Privacy Act, 2019 (Cap. 97) compliance in Uganda
One team from the Nairobi office carries the work from scoping to sign-off. Clients across Uganda are served from Sterling's Nairobi office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Uganda Data Protection and Privacy Act, 2019 (Cap. 97) and the Ugandan requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Uganda Data Protection and Privacy Act, 2019 (Cap. 97) compliance take in Uganda?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Uganda these are the factors that set the timeline.
- Number of processing activities, systems and processors to map
- Registration and renewal status with the PDPO
- Special personal data such as financial or health information in scope
- Overseas hosting that needs transfer safeguards or approval
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Uganda Data Protection and Privacy Act, 2019 (Cap. 97) compliance cost in Uganda?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Uganda these factors move both.
- Number of legal entities and business units in scope
- Volume and sensitivity of personal data handled
- Impact assessments and processor contract updates
- Security remediation and breach procedure testing
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Uganda Data Protection and Privacy Act, 2019 (Cap. 97) consultants and assessors in Uganda
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Uganda Data Protection and Privacy Act, 2019 (Cap. 97) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Uganda are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Uganda Data Protection and Privacy Act, 2019 (Cap. 97) in Uganda (3)
| Instrument | How it treats the standard |
|---|---|
| Data Protection and Privacy Act, 2019 (Data Protection and Privacy Act, Cap. 97) | The instrument itself Principles, consent and its exceptions, children's and special personal data, notice before collection, data protection officer, security, processor contracts, breach notification, processing outside Uganda, data subject rights and the data protection register. |
| Personal Data Protection Office (PDPO) portal | Regulator's services Registration with annual renewal, submission of data protection impact assessments for new projects, applications to transfer personal data outside Uganda, breach reporting and complaints. |
| National Information Security Framework (NISF) 2026, NITA-U | Context NITA-U's security framework for government bodies and critical infrastructure; it supports, but does not replace, the Act's security duties. |
Accreditation, audit language and remote audits in Uganda
Compliance, not certification: the Data Protection and Privacy Act sets duties and no certificate proves compliance with it. Evidence is entry on the data protection register with annual renewal, a designated data protection officer, notices given before collection, records of lawful basis and consent, processor contracts, security measures, impact assessments submitted to the PDPO for new projects, transfer approvals and a working breach procedure. ISO/IEC 27701 or ISO/IEC 27001 certification by an accredited body is optional supporting evidence. Edition and transition details: Uganda Data Protection and Privacy Act, 2019 (Cap. 97) hub →
Audit language
Notices and consent wording should be in a language the people concerned understand; registration, policies and records are usually kept in English, the language of the Act and the PDPO portal.
Remote and on-site
Data mapping and privacy workshops can be on-site or remote; the PDPO can carry out compliance audits and investigate complaints, so keep evidence ready to show.
Uganda Data Protection and Privacy Act, 2019 (Cap. 97) in Uganda: questions clients ask
Who must register with Uganda's Personal Data Protection Office?
Anyone collecting or processing personal data, broadly. Section 29 has every person, institution or public body that collects or processes personal data entered on the register with its purposes, and the PDPO asks collectors, processors and controllers to register and renew annually on its portal. Test whether exemptions apply to you with counsel or the PDPO.
Is there a certificate for Data Protection and Privacy Act compliance?
No. Compliance is shown through evidence: registration and renewal, a data protection officer, notices, lawful-basis records, processor contracts, security measures, impact assessments and a breach procedure. ISO/IEC 27701 or ISO/IEC 27001 certification from an accredited body can support that evidence, but it does not replace the Act's duties or the PDPO's oversight.
When must a data breach be reported in Uganda?
Immediately, once you believe personal data has been accessed or acquired by an unauthorised person. Section 23 requires notice to the Authority with the remedial action taken, and the Authority decides whether affected people must also be told, by mail, e-mail, website notice or mass media. The PDPO portal takes breach reports. Agree the details with your counsel.
Can personal data about Ugandans be stored in another country?
Yes, with conditions. Section 19 requires a controller or processor based in Uganda to ensure the receiving country protects the data at least as well as the Act, or that the person has consented. The PDPO also takes applications for approval of transfers outside Uganda. Have your cloud and hosting arrangements reviewed by counsel or the regulator.
More on Uganda Data Protection and Privacy Act, 2019 (Cap. 97) for Ugandan organisations
Other standards Ugandan businesses ask Sterling for
Organisations in Uganda often combine Uganda Data Protection and Privacy Act, 2019 (Cap. 97) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Nairobi office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection and Privacy Act, 2019 (Data Protection and Privacy Act, Cap. 97) — media.ulii.org; bills.parliament.ug (accessed 12 Oct 2026)
- Personal Data Protection Office (PDPO) portal — pdpo.go.ug (accessed 12 Oct 2026)
- National Information Security Framework (NISF) 2026, NITA-U — nita.go.ug (accessed 12 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice