Understanding Uganda’s Data Protection and Privacy Act, 2019

Uganda’s Data Protection and Privacy Act, 2019 is the country’s primary law protecting personal information. Here is what it means for consent, health data, and the rights of ordinary Ugandans.

Enacted in 2019, the Data Protection and Privacy Act (Act 9 of 2019) exists to protect the privacy of the individual and of personal data by regulating how personal information is collected and processed. It sets out the rights of people whose data is collected and the obligations of data collectors, processors, and controllers.

Who it applies to

The Act applies to anyone collecting or processing personal data within Uganda, and, importantly, to organisations outside Uganda that process the personal data of Ugandan citizens. This cross-border reach is central to ADiJUST’s work holding multinational technology companies accountable.

The core principles

Personal data must be collected lawfully and fairly, for a specific purpose, with the knowledge or consent of the data subject. The Act requires data minimality, accuracy, and limits on how long data is kept, and it places heightened restrictions on special personal data and on the data of children.

Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes.

Your rights

The Act gives people the right to access their personal data, to prevent processing that causes harm, to object to direct marketing, to challenge automated decisions, and to have inaccurate data corrected, blocked, or erased. Organisations must also secure data and notify breaches.

Enforcement

Complaints are handled by Uganda’s Personal Data Protection Office, which can investigate and order remedies, with offences including the unlawful obtaining, disclosure, or sale of personal data. It was under this framework that ADiJUST secured a landmark ruling affirming the regulator’s jurisdiction over global technology companies.

This explainer is a plain-language summary, not legal advice. For the authoritative text, download the Act from our Resource Hub.