Law / Uganda

Data Protection and Privacy Act, 2019, comprehensive personal-data regime

Data Protection and Privacy Act 2019 (Chapter 97), ss. 1-7, 10-12, 14-15, 17-18, 20-22, 29-30 (principles, lawful basis, security and registration)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03

In force since 3 May 2019.

A comprehensive regime rule binding public and private bodies.

Obligation class: Consent, Retention, Security, Licensing, Governance
Audit expectation: none

What it requires

Obtain the data subject's prior consent before collecting or processing their personal data, unless a specific ground in section 7(2) applies, such as a legal requirement, a public duty, national security, a contract with the data subject, or a legal obligation.NIST Privacy FrameworkCT.PO-P1
Stop collecting or processing a data subject's personal data if they object, unless the collection or processing falls under one of the section 7(2) grounds.NIST Privacy FrameworkCT.PO-P3
Collect personal data directly from the data subject, unless a listed exception applies, such as the data being in a public record, already made public by the data subject, or collected with their consent.NIST Privacy FrameworkGV.PO-P1
Collect personal data only for a lawful purpose that is specific, explicitly defined, and related to your functions or activities.NIST Privacy FrameworkGV.PO-P1
Process only the personal data that is necessary or relevant, and never in excess of what the law authorises or the purpose requires.NIST Privacy FrameworkGV.PO-P1
Keep the personal data you collect, process, use or hold complete, accurate, up to date and not misleading.NIST Privacy FrameworkCT.PO-P2
Use personal data collected for a specific purpose only for that purpose, unless the data subject consents, the data is already public, or a listed law-enforcement, national-security, public-health or research ground applies.NIST Privacy FrameworkGV.PO-P1
Retain personal data no longer than necessary for the purpose collected, and destroy, delete or de-identify it at the expiry of the retention period in a manner that prevents its reconstruction.NIST Privacy FrameworkCT.DM-P5
Identify foreseeable risks to personal data in your possession, establish and maintain safeguards against them, verify regularly that the safeguards work, and update them as risks or deficiencies change.NIST Privacy FrameworkPR.DS-P5
Do not let a data processor handle personal data on your behalf unless it has established and complies with this Act's security measures, and require that in your contract with the processor.NIST Privacy FrameworkID.DE-P3
As an operator or other person processing personal data on a controller's behalf, treat the data as confidential and do not disclose it unless required by law or in the course of discharging your duty.NIST Privacy FrameworkPR.DS-P5
Register with the National Information Technology Authority as a data controller or other prescribed person before collecting or processing personal data.NIST Privacy FrameworkGV.PO-P5

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.

2 more

CT.DM-P5Data are destroyed according to policy.
PR.DS-P5Protections against data leaks are implemented.

NIST CSF 2.0

GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

The sections this row cites impose no log or record duty on a controller. Section 29(2) has the Authority keep a data protection register of every person collecting or processing personal data and the purpose, and section 30 opens that register to inspection by any person; the controller's part is to apply to be registered, which is a filing with the regulator and not a record the controller keeps. Section 18 limits how long personal data is retained, which limits the data and not a log, and section 3(1)(a) only says a controller is accountable to the data subject. No section cited here gives the Authority a power to demand records or to audit. The territorial scope in section 1 reaches both processing within Uganda and processing outside Uganda of personal data relating to Ugandan citizens; neither prong is an establishment, targeting or residence test, so no hook value is coded.

Kind: None
As of: 28 October 2026

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Act applies to a person, institution or public body collecting, processing, holding or using personal data within Uganda, and to a person outside Uganda doing the same in relation to a Ugandan citizen's data (s. 1).

It establishes a personal data protection office within the National Information Technology Authority - Uganda (the Authority) to enforce the accountability, fairness, lawfulness, adequacy, quality, transparency and security principles of s. 3, and requires every institution to designate its own data protection officer (s. 6).

A person must not collect or process personal data without the data subject's prior consent, unless a public duty, national security, an offence-related purpose, a contract with the data subject, a medical purpose or another legal obligation applies, and processing must stop if the data subject objects outside those grounds (s. 7).

Personal data must be collected directly from the data subject unless a listed exception applies, such as the data already being in a public record or made public by the data subject, and it must be collected only for a specific, explicitly defined lawful purpose related to the collector's functions (ss. 11-12).

Further processing of data already held must stay compatible with the purpose it was collected for, unless the data subject consents, the data is public, or a listed law-enforcement, national-security, public-health or research ground applies (s. 17).

A data controller must process no more than the necessary or relevant data, keep it complete, accurate, up to date and not misleading, retain it no longer than necessary unless a listed ground extends retention, and destroy or de-identify it at the expiry of the retention period in a manner that prevents reconstruction (ss. 14-15, 18).

A data controller, collector or processor must secure personal data with appropriate technical and organisational measures against loss, damage, unauthorised destruction and unlawful access, identifying foreseeable risks, maintaining safeguards against them, verifying they work and updating them, and observing generally accepted security practices (s. 20); a data controller may not let a data processor handle personal data unless the processor meets those same security measures, and the processing contract between them must require it (s. 21), while an operator or other person processing on a controller's behalf must treat the data as confidential and not disclose it except where the law requires or the duty calls for it (s. 22).

The Authority keeps a data protection register in which every person, institution or public body collecting or processing personal data must register, and makes that register available for public inspection (ss. 29-30).

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.