Data Protection and Privacy Act

The Act applies to any person, institution or public body that collects, processes, holds or uses personal data within Uganda, and to those outside Uganda who collect, process, hold or use personal data relating to Ugandan citizens.

Section Interpretation Section In this Act unless the context otherwise requires — “ Authority ” means the National Information Technology Authority - Uganda; “ consent ” means any freely given, specific, informed and unambiguous

Data collectors, processors and controllers must follow principles of data protection including accountability, fair and lawful processing, data minimisation, retention limits, quality, transparency and security; the Authority must ensure compliance.

Establishes a personal data protection office that reports directly to the Board, headed by a national personal data protection director who must meet specified appointment terms and qualifications, and which shall include other officers as necessary.

The personal data protection office must oversee and enforce the Act, promote privacy rights, monitor and report on privacy observance, run awareness programmes, investigate complaints, maintain a register, perform other prescribed or necessary functions, and has all powers necessary; it must not be under the direction or control of any person or Authority.

The head of an institution must designate a person as the data protection officer to ensure compliance with the Act.

Data collectors, data processors and data controllers must not collect, hold or process personal data in a way that infringes the privacy of a data subject.

A person must collect personal data directly from the data subject, except where the text lists specific exceptions allowing collection from other sources.

A person who collects personal data must collect it only for a lawful, specific, explicitly defined purpose related to the collector's functions or activities.

A person collecting personal data must inform the data subject about specified topics (what data, collector identity, purpose, whether supply is mandatory, consequences of failure, legal basis, recipients, access and rectification rights, and retention period).

A data controller or data processer must only process personal data that is necessary or relevant, and must not process personal data in excess of what is authorised by law or needed for a specific purpose.

Data collectors/processors/controllers must ensure personal data they handle is complete, accurate, up-to-date and not misleading; data subjects must ensure the personal data they provide meets the same standards.

Data subjects may request correction or deletion of their personal data; data controllers must comply or notify and explain rejections, inform recipients of corrections, and notify the data subject of actions taken.

Persons processing or holding personal data must ensure further processing is compatible with the original purpose; they must consider specified factors, and further processing is allowed in specified cases such as consent, public availability, law enforcement, court proceedings, national security, or serious threats to health or safety.

Persons who collect personal data must not keep it longer than necessary, except for listed legal and other reasons; those who use data for decisions must retain it as required by law or to allow access; data controllers must destroy or de-identify records at the end of the retention period.

When a data processor or data controller based in Uganda processes or stores personal data outside Uganda, they must ensure either that the receiving country has adequate data protection or that the data subject has consented.

A person must not collect or process personal data without the prior consent of the data subject, subject to the exceptions listed in subsection (2).

A person must not collect or process personal data relating to a child unless one of three conditions applies: prior consent of a parent/guardian/other decision-maker; necessity to comply with the law; or for research or statistical purposes.

The provision forbids persons from collecting or processing highly sensitive personal data (religion, political opinion, sexual life, financial information, health/medical records) while allowing data collectors/processors/controllers to collect or process personal data specified in subsection (1) in several limited situations including legitimate association activities, employer legal obligations, consent, non-profit or association membership contexts; it excludes data collected under the Uganda Bureau of Statistics Act.

Data controllers, data collectors and data processors must secure the integrity of personal data by adopting appropriate reasonable technical and organisational measures and data controllers must identify risks, establish safeguards, verify their implementation and keep them updated; data controllers must also observe generally accepted information security practices and any specific industry or professional rules.

Data controllers must not allow a data processor to process their personal data unless the processor has established and complies with required security measures; contracts between controllers and processors must require the processor to establish and maintain confidentiality and security measures to protect data integrity.

Operators and persons processing personal data for a data controller must process the data only with the controller's prior knowledge or authorisation and must treat such personal data as confidential; a data processor must not disclose the data except when required by law or in the course of discharging a duty.

If a data collector, processor or controller believes personal data was accessed or acquired without authorization they must immediately notify the Authority in the prescribed manner; the Authority will decide if the data subject should be notified and, when it determines notification is required, the notifier must use one of the listed methods.

Data subjects who provide proof of identity may request access to personal information; data controllers must verify identity, may refuse where disclosure would identify another individual unless exceptions apply, and must respond promptly and in any event within thirty days.

A data subject may give written notice at any time to a data controller or processor to require them to stop processing personal data that causes or is likely to cause unwarranted substantial damage or distress.

Data subjects may, by written notice, require a data controller to stop processing their personal data for direct marketing; the data controller must inform the data subject within 14 days whether it has complied or will comply or the reasons for non‑compliance; the Authority may be given a copy of the notice and may direct compliance if satisfied.

Section Rights in relation to automated decision-taking Section Without prejudice to subsection (1), where a decision which significantly affects a data subject is based solely on automated processing — This section does not apply to a

If the Authority finds personal data about a data subject is inaccurate after a complaint, it may order the data controller to rectify, update, block, erase or destroy the data; and when data has been changed, the data controller must notify third parties previously disclosed to.

The Authority must keep and maintain a data protection register and register persons and bodies who collect or process personal data; applications to register by data controllers or other persons must be made in the prescribed manner.

The Authority must make the information in the Data Protection Register available for inspection by any person.

A data subject or any person who believes their rights are infringed may make a complaint to the Authority; a data collector, data processor or data controller may in writing complain to the Authority about violations or non-compliance.

The Authority must investigate every complaint made under this Part and may direct data collectors, processors or controllers to remedy breaches or take actions to restore data integrity or data subject rights.

A data subject who suffers damage or distress caused by a data controller, processor or collector breaching the Act may apply to a court for compensation; in proceedings the person can defend by proving they took reasonable care to comply with the Act.

A person aggrieved by a decision of the Authority may appeal to the Minister.

A person must not unlawfully obtain, disclose or procure disclosure of personal data held or processed by a data collector, data controller or data processor; contravention is an offence punishable by a fine up to 240 currency points or up to ten years' imprisonment or both.

A person must not unlawfully destroy, delete, mislead, conceal or alter personal data.

A person must not sell or offer for sale another person's personal data; violating this is an offence punishable by a fine (not exceeding two hundred and forty five currency points), imprisonment (not exceeding ten years), or both.

If an offence under sections 35, 36 or 37 is committed by a corporation, the corporation and any officer who knowingly and willfully authorises or permits it commits the offence; a court that convicts may order the corporation to pay a fine not exceeding two percent of the corporation's annual gross turnover, and the court must take into account the gravity and impact of the offence when deciding the fine.

The Minister may make regulations by statutory instrument, after consulting the Authority, on matters needed to give effect to the Act including retention periods for personal data.

The Minister may amend the Schedule, subject to Cabinet approval and by statutory instrument.