UgandaData Protection and Privacy Act, 2019, cross-border transfer
Data Protection and Privacy Act, 2019, s. 19 (cross-border transfer)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03In force since .
A cross border transfer rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before processing or storing personal data outside Uganda, confirm that the destination country's personal data protection measures are at least equivalent to this Act's, or obtain the data subject's consent to the transfer.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 19 requires a controller or processor based in Uganda that processes or stores personal data outside Uganda to ensure the destination country has equivalent protection or that the data subject has consented. It names no record of the check or the consent, and no audit or access right. Its opening words, a controller or processor based in Uganda, state an establishment test.
- Kind
- None
- As of
What this law does
Section 19 requires a data processor or data controller based in Uganda that processes or stores personal data outside Uganda to ensure either that the destination country has measures protecting personal data at least equivalent to this Act's, or that the data subject has consented to the transfer.
The Act sets no prior government-authorisation requirement and names no localisation duty; the section's two grounds, an adequacy-equivalent destination or consent, are the only conditions it states for a transfer outside Uganda.
When LexLint raises it
When your app profile says your app ships a mobile app or processes personal data.
Back to the example · Lint your app
Page updated .