UgandaData Protection and Privacy Act, 2019, automated decisions
Data Protection and Privacy Act, 2019, s. 27 (automated individual decisions)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
As of .
What it requires
- Do not base a decision that significantly affects a data subject solely on automated processing where they have given written notice against it, and where such a decision is made, notify the data subject and reconsider it within twenty-one days of their written request.
What this law does
Section 27 lets a data subject require in writing that a data controller not base a decision significantly affecting them solely on the processing of their personal data by automatic means.
Where a controller does base such a decision solely on automated processing, it must tell the data subject that fact as soon as reasonably practicable, and the data subject can require reconsideration within twenty-one days, with the controller answering in writing within a further twenty-one days of that request. The section does not apply to a decision made in considering, entering into or performing a contract with the data subject, or for a purpose a law authorises or requires.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.