UgandaData Protection and Privacy Act, 2019, rights of data subjects
Data Protection and Privacy Act, 2019, ss. 13, 16, 24-26, 28 (rights of data subjects)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Before or as soon as practicable after collecting personal data, tell the data subject its nature and category, your name and address, the purpose, whether supplying it is discretionary or mandatory, the consequences of not providing it, the recipients, their rights of access and rectification, and the retention period.NIST Privacy FrameworkCM.AW-P1
- Correct or delete personal data on a data subject's request where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, tell the data subject the outcome, and notify every person the data was previously disclosed to of a correction made.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Answer a data subject's request to confirm whether you hold their personal data, describe it, and identify any third party with access to it, within thirty days of the request.NIST Privacy FrameworkCT.DM-P1
- Stop processing personal data within fourteen days of a data subject's written notice that the processing causes or is likely to cause them unwarranted substantial damage or distress, unless the processing falls under section 7(2), and comply within seven days if the Authority orders you to.NIST Privacy FrameworkCT.PO-P3
- Stop processing a data subject's personal data for direct marketing within fourteen days of their written notice to do so.NIST Privacy FrameworkCT.PO-P3
- Rectify, update, block, erase or destroy personal data the Authority finds inaccurate on a data subject's complaint, and notify every third party the data was previously disclosed to of that action.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The cited sections give a data subject notice, correction, access, objection and marketing-opt-out rights with response times. A controller that refuses a section 25 notice sends the Authority a copy of its written reasons within fourteen days, which is a report of a refusal and not a record the controller keeps; section 24(1)(c) has a controller identify third parties that have had access to data on request but names no record. The Authority acts on a data subject's complaint (sections 25(4) and 28(1)) and is given no power in these sections to demand or audit records. No scope clause is cited.
- Kind
- None
- As of
What this law does
Section 13 requires a person collecting personal data to inform the data subject, before or as soon as practicable after collection, of the nature and category of the data, the collector's name and address, the purpose, whether supplying the data is discretionary or mandatory, the consequences of not providing it, the authorised or legal requirement for collecting it, the recipients, the existence of the rights of access and rectification, and the retention period, subject to law-enforcement, national-security and revenue-collection exceptions.
Section 16 gives a data subject the right to have a data controller correct or delete personal data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or destroy a record the controller no longer has authority to retain, with the controller telling the data subject the outcome and notifying every person the data was disclosed to of a correction made.
Section 24 gives a data subject who proves their identity the right to confirmation of whether a controller holds their personal data, a description of it, and the identity of any third party with access to it, to be answered within thirty days subject to a third party's own privacy.
Section 25 lets a data subject require a controller or processor in writing to stop processing that causes or is likely to cause them unwarranted substantial damage or distress, other than processing under section 7(2), with the controller answering within fourteen days and the Authority able to order compliance within seven.
Section 26 lets a data subject require a controller in writing to stop processing their data for direct marketing, again with a fourteen-day answer and an Authority order available. Section 28 lets the Authority, on a data subject's complaint that their data is inaccurate, order a controller to rectify, update, block, erase or destroy it, with the controller then notifying every third party the data was previously disclosed to.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .