Processes personal data, in Uganda

Data Protection and Privacy Act, 2019 (Chapter 97), ss. 1-7, 10-12, 14-15, 17-18, 20-22, 29-30 (principles, lawful basis, security and registration) · Read the law's page

• Obtain the data subject's prior consent before collecting or processing their personal data, unless a specific ground in section 7(2) applies, such as a legal requirement, a public duty, national security, a contract with the data subject, or a legal obligation.
• Stop collecting or processing a data subject's personal data if they object, unless the collection or processing falls under one of the section 7(2) grounds.
• Collect personal data directly from the data subject, unless a listed exception applies, such as the data being in a public record, already made public by the data subject, or collected with their consent.
• Collect personal data only for a lawful purpose that is specific, explicitly defined, and related to your functions or activities.
• Process only the personal data that is necessary or relevant, and never in excess of what the law authorises or the purpose requires.
• Keep the personal data you collect, process, use or hold complete, accurate, up to date and not misleading.
• Use personal data collected for a specific purpose only for that purpose, unless the data subject consents, the data is already public, or a listed law-enforcement, national-security, public-health or research ground applies.
• Retain personal data no longer than necessary for the purpose collected, and destroy, delete or de-identify it at the expiry of the retention period in a manner that prevents its reconstruction.
• Identify foreseeable risks to personal data in your possession, establish and maintain safeguards against them, verify regularly that the safeguards work, and update them as risks or deficiencies change.
• Do not let a data processor handle personal data on your behalf unless it has established and complies with this Act's security measures, and require that in your contract with the processor.
• As an operator or other person processing personal data on a controller's behalf, treat the data as confidential and do not disclose it unless required by law or in the course of discharging your duty.
• Register with the National Information Technology Authority as a data controller or other prescribed person before collecting or processing personal data.

Data Protection and Privacy Act, 2019, s. 19 (cross-border transfer) · Read the law's page

• Before processing or storing personal data outside Uganda, confirm that the destination country's personal data protection measures are at least equivalent to this Act's, or obtain the data subject's consent to the transfer.

Data Protection and Privacy Act, 2019, s. 23 (breach notification) · Read the law's page

• Notify the National Information Technology Authority immediately after you believe personal data has been accessed or acquired by an unauthorised person, describing the access or acquisition and the remedial action taken.
• Wait for the Authority to determine whether you must also notify the affected data subject of the breach; the Act sets no separate deadline for that notice.
• Where the Authority determines the data subject must be notified, do so by registered mail to their last known address, electronic mail to their last known address, prominent placement on your website, or publication in the mass media, giving sufficient information for them to take protective measures.
• Publicise the breach in the manner the Authority specifies if it directs you to, where the Authority has grounds to believe publicity would protect an affected data subject.

Data Protection and Privacy Act, 2019, ss. 13, 16, 24-26, 28 (rights of data subjects) · Read the law's page

• Before or as soon as practicable after collecting personal data, tell the data subject its nature and category, your name and address, the purpose, whether supplying it is discretionary or mandatory, the consequences of not providing it, the recipients, their rights of access and rectification, and the retention period.
• Correct or delete personal data on a data subject's request where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, tell the data subject the outcome, and notify every person the data was previously disclosed to of a correction made.
• Answer a data subject's request to confirm whether you hold their personal data, describe it, and identify any third party with access to it, within thirty days of the request.
• Stop processing personal data within fourteen days of a data subject's written notice that the processing causes or is likely to cause them unwarranted substantial damage or distress, unless the processing falls under section 7(2), and comply within seven days if the Authority orders you to.
• Stop processing a data subject's personal data for direct marketing within fourteen days of their written notice to do so.
• Rectify, update, block, erase or destroy personal data the Authority finds inaccurate on a data subject's complaint, and notify every third party the data was previously disclosed to of that action.

Data Protection and Privacy Act, 2019, ss. 31-38 (enforcement and offences) · Read the law's page

• Expect a data subject or any other person to be able to complain to the National Information Technology Authority that you are infringing their rights or violating this Act, and expect the Authority to investigate every complaint and be able to direct you to remedy a breach.
• Expect a data subject who suffers damage or distress from your contravention of this Act to be able to sue you in court for compensation, and be ready to prove you took reasonable care to comply in order to defend the claim.
• Do not unlawfully obtain, disclose, destroy, delete, mislead, conceal, alter, sell or offer to sell personal data, on pain of a fine of two hundred and forty to two hundred and forty five currency points or imprisonment of up to ten years, or both.
• Expect a convicted corporation to face an additional fine of up to two percent of its annual gross turnover, and expect an officer who knowingly and wilfully authorised or permitted the offence to be liable alongside it.

Data Protection and Privacy Act, 2019, ss. 8-9 (children and special personal data) · Read the law's page

• Do not collect or process a child's personal data unless the child's parent, guardian, or another person with authority to decide for the child has given prior consent, or the collection or processing is necessary to comply with the law or is for research or statistical purposes.
• Do not collect or process personal data about an individual's religious or philosophical beliefs, political opinion, sexual life, financial information, or health status or medical records, unless a listed exception applies.
• Where a listed exception permits it, collect or process that special personal data only under an employer's legal right or duty, with the data subject's free consent, or as a non-profit political, philosophical, religious or trade union body processing its own members' or contacts' data without disclosing it to a third party without their consent.