UgandaData Protection and Privacy Act, 2019, children and special personal data
Data Protection and Privacy Act, 2019, ss. 8-9 (children and special personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent
- Audit expectation
- none
What it requires
- Do not collect or process a child's personal data unless the child's parent, guardian, or another person with authority to decide for the child has given prior consent, or the collection or processing is necessary to comply with the law or is for research or statistical purposes.
- Do not collect or process personal data about an individual's religious or philosophical beliefs, political opinion, sexual life, financial information, or health status or medical records, unless a listed exception applies.
- Where a listed exception permits it, collect or process that special personal data only under an employer's legal right or duty, with the data subject's free consent, or as a non-profit political, philosophical, religious or trade union body processing its own members' or contacts' data without disclosing it to a third party without their consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 8 and 9 forbid collecting or processing a child's data, or special personal data, without prior parental consent or a listed ground. They require that consent or ground to exist but say nothing about recording, demonstrating or producing it, so no log or record duty is read in. The two sections carry no scope clause.
- Kind
- None
- As of
What this law does
Section 8 bars a person from collecting or processing a child's personal data unless it is carried out with the prior consent of the child's parent, guardian or another person with authority to decide for the child, or is necessary to comply with the law, or is for research or statistical purposes.
Section 9(1) bars a person from collecting or processing personal data relating to an individual's religious or philosophical beliefs, political opinion, sexual life, financial information, or health status or medical records, and section 9(2) exempts information collected under the Uganda Bureau of Statistics Act from that bar.
Section 9(3) permits collection or processing of that special personal data only where it is exercised or performed under a right or obligation a law imposes on an employer, where the data subject gives it freely and with consent, or where a non-profit political, philosophical, religious or trade union body collects or processes it for its own legitimate activities about its own members or regular contacts and does not disclose it to a third party without the data subject's consent.
The enumerated special-category list does not name biometric or genetic data, so a biometric identifier is not treated as special personal data under this Act.
When LexLint raises it
When your app profile says your app serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .