Runs an essential service, in Uganda

Data Protection and Privacy Act, 2019, s. 23 (breach notification) · Read the law's page

• Notify the National Information Technology Authority immediately after you believe personal data has been accessed or acquired by an unauthorised person, describing the access or acquisition and the remedial action taken.
• Wait for the Authority to determine whether you must also notify the affected data subject of the breach; the Act sets no separate deadline for that notice.
• Where the Authority determines the data subject must be notified, do so by registered mail to their last known address, electronic mail to their last known address, prominent placement on your website, or publication in the mass media, giving sufficient information for them to take protective measures.
• Publicise the breach in the manner the Authority specifies if it directs you to, where the Authority has grounds to believe publicity would protect an affected data subject.