CevroUganda: Data Protection and Privacy Act 2019 and what it requires
Data Protection and Privacy Act 2019: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Personal Data Protection Office (Uganda).
Key requirements at a glance
| Registration with the regulator | Required |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Administrative penalties under the Act.
What to know in practice
Registration and core processing principles are established; enforcement is less mature than Kenya's or South Africa's.
How Cevro helps
- Maps Data Protection and Privacy Act 2019 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Uganda?
Personal Data Protection Office (Uganda) oversees Data Protection and Privacy Act 2019.
Is breach notification mandatory under Data Protection and Privacy Act 2019?
Our reference does not record a fixed hourly deadline for Data Protection and Privacy Act 2019. Check the statute and Personal Data Protection Office (Uganda) guidance for the notification timing that applies to you.
Does Uganda restrict cross-border data transfers?
Yes. Moving personal data out of Uganda is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Data Protection and Privacy Act 2019?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in Uganda?
Administrative penalties under the Act.