UgandaData Protection and Privacy Act, 2019, enforcement and offences
Data Protection and Privacy Act, 2019, ss. 31-38 (enforcement and offences)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- none
What it requires
- Expect a data subject or any other person to be able to complain to the National Information Technology Authority that you are infringing their rights or violating this Act, and expect the Authority to investigate every complaint and be able to direct you to remedy a breach.
- Expect a data subject who suffers damage or distress from your contravention of this Act to be able to sue you in court for compensation, and be ready to prove you took reasonable care to comply in order to defend the claim.
- Do not unlawfully obtain, disclose, destroy, delete, mislead, conceal, alter, sell or offer to sell personal data, on pain of a fine of two hundred and forty to two hundred and forty five currency points or imprisonment of up to ten years, or both.
- Expect a convicted corporation to face an additional fine of up to two percent of its annual gross turnover, and expect an officer who knowingly and wilfully authorised or permitted the offence to be liable alongside it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Unlawfully obtaining or disclosing personal data is punishable by a fine not exceeding 240 currency points (UGX 4,800,000) or imprisonment for ten years, or both (s. 35); selling or offering to sell personal data by a fine not exceeding 245 currency points (UGX 4,900,000) or imprisonment not exceeding ten years, or both (s. 37); unlawfully destroying, deleting, misleading, concealing or altering personal data by a fine of not less than 240 currency points (UGX 4,800,000), with no maximum fine stated, or imprisonment not exceeding ten years, or both (s. 36). A convicted corporation may additionally be fined up to two percent of its annual gross turnover (s. 38(2)). One currency point is twenty thousand shillings (Schedule).
Penalty structure
The highest fixed maximum among the Act's offences that state one (sale of personal data, s. 37(2), 245 currency points at UGX 20,000 per currency point); unlawful obtaining or disclosure (s. 35(2)) is capped at 240 currency points (UGX 4,800,000). Unlawful destruction, deletion or alteration (s. 36(2)) states a fine of not less than 240 currency points and no maximum fine. Each offence also carries imprisonment of up to ten years, as an alternative or in addition. A convicted corporation may additionally be fined up to two percent of its annual gross turnover (s. 38(2)).
- Rule
- Fixed only
- As of
- Currency
- UGX
- Fixed cap
- 4,900,000
Who enforces it
Enforcement body
National Information Technology Authority - Uganda (Personal Data Protection Office)
Settledness
- As of
- Open questions
- Does the fine of 'not less than two hundred and forty currency points' in section 36(2) leave a court free to impose a fine above that figure, given that the subsection states no maximum fine?
What it makes you log
Logging duty
Sections 31 to 38 set out complaints to the Authority, its duty to investigate each complaint and direct a remedy, compensation in court, appeals to the Minister and the offences. Section 36 makes it an offence to unlawfully destroy, delete, conceal or alter personal data, which protects the data and does not oblige anyone to keep a record. The Authority is given no power in these sections to demand records or inspect, so no audit expectation is read in. No scope clause.
- Kind
- None
- As of
What this law does
Section 31 lets a data subject or any other person complain to the Authority in the prescribed manner that a data collector, processor or controller is infringing their rights or violating the Act, and lets a data collector, processor or controller itself complain to the Authority in writing about a violation or non-compliance.
Section 32 requires the Authority to investigate every complaint and lets it direct a data collector, processor or controller to remedy a breach or take other action to restore the integrity of the data or the data subject's rights.
Section 33 gives a data subject who suffers damage or distress through a contravention of the Act a right to apply to a court of competent jurisdiction for compensation from the data collector, processor or controller responsible, a private right of action, subject to the defence that the person took reasonable care to comply. Section 34 lets a person aggrieved by an Authority decision appeal to the Minister within thirty days, with a copy of the appeal going to the Authority.
Sections 35 to 37 make it an offence to unlawfully obtain, disclose or procure the disclosure of personal data, to unlawfully destroy, delete, mislead, conceal or alter it, or to sell or offer to sell it, each punishable on conviction by a fine of two hundred and forty to two hundred and forty five currency points (twenty thousand Uganda shillings per currency point) or imprisonment of up to ten years, or both.
Section 38 extends those offences to a corporation and to any officer who knowingly and wilfully authorises or permits the contravention, and lets a court additionally fine a convicted corporation up to two percent of its annual gross turnover, having regard to the gravity and impact of the offence.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .