Almost every business in Uganda now collects personal data. A salon keeps clients' phone numbers on WhatsApp. A school stores pupils' details and parents' contacts. A SACCO holds members' National ID numbers. An online shop keeps delivery addresses and mobile money numbers. Even a CCTV camera at the gate collects personal data.
All of this is covered by the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021. Enforcement has picked up: in 2025 a director of a digital lending company was convicted and fined for failing to register and for misusing borrowers' data, and the regulator ruled against a major global tech company for not registering. This guide explains, in plain language, what your business must do. It is general information, not legal advice.
Who the law applies to
The Act applies to anyone who collects, holds or uses personal data in Uganda, and to organisations outside Uganda that process the data of people in Uganda. It uses three main terms:
- Data collector: the person or business that collects the data.
- Data controller: the person or business that decides why and how the data is used.
- Data processor: someone who handles data on another's behalf, such as an IT company, payroll provider or cloud service.
Personal data includes names, phone numbers, addresses, ID numbers, photos, financial details and more. Some data is treated as special personal data and needs extra care, including information about health and medical records, religious or philosophical beliefs, political opinions, sexual life and financial information.
Step 1: Register with the PDPO
The Personal Data Protection Office (PDPO), which sits under the National Information Technology Authority, Uganda (NITA-U), enforces the Act. Every data collector, controller and processor is required to register with the PDPO, and registration is renewed every year.
Registration is done online through the PDPO website. You will typically provide:
- Your business details and registration documents.
- The types of personal data you collect and why.
- Details of your data protection officer or contact person.
- Whether you transfer data outside Uganda, and the safeguards you use.
- The security measures you have in place.
At the time of writing, published guidance put the registration fee at about UGX 100,000, with annual renewal at a similar amount. Confirm the current fee and process directly with the PDPO.
Step 2: Collect data lawfully and with consent
The core rule is simple: only collect what you need, for a clear purpose, and tell people about it. In practice:
- Get consent before collecting personal data, unless another lawful reason applies (for example, a legal duty or performing a contract with the person).
- Collect directly from the person wherever possible.
- Tell people what you are collecting, why, who you share it with and how they can contact you. A short privacy notice on forms, your website and your app does this.
- Do not use data for a different purpose without new consent. Customer numbers collected for deliveries should not end up in a marketing campaign or be sold to another company.
- Children's data (under 18) generally needs the consent of a parent or guardian. Schools, clinics and children's brands should take this seriously.
Step 3: Keep data secure and accurate
You must take reasonable technical and organisational steps to protect the data you hold. For a small business that can mean:
- Passwords and two-step verification on email, laptops and shared drives.
- Limiting who on your team can see customer lists and ID copies.
- Locking away paper files, such as client forms and photocopied IDs.
- Written agreements with any processor, such as your IT provider or cloud host, covering how they protect your data.
- Keeping data accurate and up to date, and deleting or anonymising it when you no longer need it.
Step 4: Respect people's rights
People whose data you hold can ask to access it, correct it, have it deleted in some cases and object to its use, including asking you to stop direct marketing to them. Have a simple way to receive and answer these requests, such as a dedicated email address, and respond promptly. If you send bulk SMS or WhatsApp promotions, always include a way to opt out.
Step 5: Handle data breaches properly
A data breach is when personal data is accessed, lost or disclosed without authorisation, for example a hacked email account, a stolen laptop or a staff member leaking a customer list. The Act requires you to notify the PDPO immediately once you have reason to believe a breach has happened. The PDPO then guides you on whether and how to inform the affected people.
Prepare a short breach plan now: who investigates, who contacts the PDPO, how you contain the problem and how you record what happened.
Step 6: Be careful with data sent abroad
Many businesses use foreign cloud services for email, storage and customer management. You may transfer personal data outside Uganda only where the destination has adequate protection, comparable to Uganda's, or where the person has consented. Keep records of what you transfer, where and why.
Penalties for getting it wrong
Offences under the Act can attract fines of up to 245 currency points (about UGX 4.9 million) and, for some offences, imprisonment of up to 10 years, or both. For companies, fines can reach up to 2% of annual gross turnover. People whose data is misused can also go to court for compensation. Beyond the law, a data scandal can destroy customer trust overnight.
Common mistakes to avoid
- Assuming the law is only for big companies. Registration applies to small businesses too.
- Photocopying IDs by default. Only collect ID copies where you truly need them, and store them securely.
- Adding customers to marketing lists without permission.
- Sharing customer data on personal phones and WhatsApp groups with no controls.
- Keeping data forever. Set retention periods and stick to them.
- Using debt collection tactics that expose borrowers' data to their contacts, which led to Uganda's first conviction.
Frequently asked questions
Does a small shop or salon need to register with the PDPO?
The law requires every data collector, controller and processor to register. If you keep customer details, assume it applies and confirm with the PDPO.
How often must we renew PDPO registration?
Registration is renewed annually. Set a reminder so it does not lapse.
Do we need a data protection officer?
The law requires a data protection officer in certain cases, such as large-scale monitoring or processing of special personal data. Smaller businesses should still name a responsible person as the contact for data issues.
Is CCTV footage personal data?
Yes, if people can be identified. Put up clear signs, limit access to recordings and do not keep footage longer than you need.
Do foreign companies have to comply?
Yes. The Act applies to organisations outside Uganda that process the data of people in Uganda.
Talk to an expert
Getting compliant is easier than it sounds once you know what data you hold and why. A short call can help you prepare your PDPO registration, draft a privacy notice and set up a simple breach plan. You can book a verified data protection lawyer on The Quick Consult to review your business. This guide is general information at the time of writing, so always confirm requirements and fees with the PDPO.