Handles health records, in Uganda

Data Protection and Privacy Act, 2019, s. 23 (breach notification) · Read the law's page

• Notify the National Information Technology Authority immediately after you believe personal data has been accessed or acquired by an unauthorised person, describing the access or acquisition and the remedial action taken.
• Wait for the Authority to determine whether you must also notify the affected data subject of the breach; the Act sets no separate deadline for that notice.
• Where the Authority determines the data subject must be notified, do so by registered mail to their last known address, electronic mail to their last known address, prominent placement on your website, or publication in the mass media, giving sufficient information for them to take protective measures.
• Publicise the breach in the manner the Authority specifies if it directs you to, where the Authority has grounds to believe publicity would protect an affected data subject.

Data Protection and Privacy Act, 2019, ss. 8-9 (children and special personal data) · Read the law's page

• Do not collect or process a child's personal data unless the child's parent, guardian, or another person with authority to decide for the child has given prior consent, or the collection or processing is necessary to comply with the law or is for research or statistical purposes.
• Do not collect or process personal data about an individual's religious or philosophical beliefs, political opinion, sexual life, financial information, or health status or medical records, unless a listed exception applies.
• Where a listed exception permits it, collect or process that special personal data only under an employer's legal right or duty, with the data subject's free consent, or as a non-profit political, philosophical, religious or trade union body processing its own members' or contacts' data without disclosing it to a third party without their consent.