Uganda

Section 23(1) requires a data collector, processor or controller that believes a data subject's personal data has been accessed or acquired by an unauthorised person to notify the Authority immediately, in the prescribed manner, of the access or acquisition and the remedial action taken; the Act states no numbered grace period, the clock is 'immediately' from the point the collector, processor or controller believes the breach occurred.

Section 23(2) leaves the decision on whether the data subject must also be told to the Authority rather than to the data collector, processor or controller, and the Act sets no independent deadline for that data-subject notice; it runs from the Authority's own determination, not from the breach.

Where the Authority does direct notice to the data subject, section 23(3) requires it by registered mail to their last known address, electronic mail to their last known address, a prominent position on the responsible party's website, or publication in the mass media, and section 23(4) requires it to carry sufficient information for the data subject to take protective measures.

Section 23(5) lets the Authority direct the responsible party to publicise the breach where the Authority has grounds to believe publicity would protect an affected data subject.

The Act applies to a person, institution or public body collecting, processing, holding or using personal data within Uganda, and to a person outside Uganda doing the same in relation to a Ugandan citizen's data (s. 1).

It establishes a personal data protection office within the National Information Technology Authority - Uganda (the Authority) to enforce the accountability, fairness, lawfulness, adequacy, quality, transparency and security principles of s. 3, and requires every institution to designate its own data protection officer (s. 6).

A person must not collect or process personal data without the data subject's prior consent, unless a public duty, national security, an offence-related purpose, a contract with the data subject, a medical purpose or another legal obligation applies, and processing must stop if the data subject objects outside those grounds (s. 7).

Personal data must be collected directly from the data subject unless a listed exception applies, such as the data already being in a public record or made public by the data subject, and it must be collected only for a specific, explicitly defined lawful purpose related to the collector's functions (ss. 11-12).

Further processing of data already held must stay compatible with the purpose it was collected for, unless the data subject consents, the data is public, or a listed law-enforcement, national-security, public-health or research ground applies (s. 17).

A data controller must process no more than the necessary or relevant data, keep it complete, accurate, up to date and not misleading, retain it no longer than necessary unless a listed ground extends retention, and destroy or de-identify it at the expiry of the retention period in a manner that prevents reconstruction (ss. 14-15, 18).

A data controller, collector or processor must secure personal data with appropriate technical and organisational measures against loss, damage, unauthorised destruction and unlawful access, identifying foreseeable risks, maintaining safeguards against them, verifying they work and updating them, and observing generally accepted security practices (s. 20); a data controller may not let a data processor handle personal data unless the processor meets those same security measures, and the processing contract between them must require it (s. 21), while an operator or other person processing on a controller's behalf must treat the data as confidential and not disclose it except where the law requires or the duty calls for it (s. 22).

The Authority keeps a data protection register in which every person, institution or public body collecting or processing personal data must register, and makes that register available for public inspection (ss. 29-30).

Section 19 requires a data processor or data controller based in Uganda that processes or stores personal data outside Uganda to ensure either that the destination country has measures protecting personal data at least equivalent to this Act's, or that the data subject has consented to the transfer.

The Act sets no prior government-authorisation requirement and names no localisation duty; the section's two grounds, an adequacy-equivalent destination or consent, are the only conditions it states for a transfer outside Uganda.

Section 27 lets a data subject require in writing that a data controller not base a decision significantly affecting them solely on the processing of their personal data by automatic means.

Where a controller does base such a decision solely on automated processing, it must tell the data subject that fact as soon as reasonably practicable, and the data subject can require reconsideration within twenty-one days, with the controller answering in writing within a further twenty-one days of that request. The section does not apply to a decision made in considering, entering into or performing a contract with the data subject, or for a purpose a law authorises or requires.

Section 13 requires a person collecting personal data to inform the data subject, before or as soon as practicable after collection, of the nature and category of the data, the collector's name and address, the purpose, whether supplying the data is discretionary or mandatory, the consequences of not providing it, the authorised or legal requirement for collecting it, the recipients, the existence of the rights of access and rectification, and the retention period, subject to law-enforcement, national-security and revenue-collection exceptions.

Section 16 gives a data subject the right to have a data controller correct or delete personal data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or destroy a record the controller no longer has authority to retain, with the controller telling the data subject the outcome and notifying every person the data was disclosed to of a correction made.

Section 24 gives a data subject who proves their identity the right to confirmation of whether a controller holds their personal data, a description of it, and the identity of any third party with access to it, to be answered within thirty days subject to a third party's own privacy.

Section 25 lets a data subject require a controller or processor in writing to stop processing that causes or is likely to cause them unwarranted substantial damage or distress, other than processing under section 7(2), with the controller answering within fourteen days and the Authority able to order compliance within seven.

Section 26 lets a data subject require a controller in writing to stop processing their data for direct marketing, again with a fourteen-day answer and an Authority order available. Section 28 lets the Authority, on a data subject's complaint that their data is inaccurate, order a controller to rectify, update, block, erase or destroy it, with the controller then notifying every third party the data was previously disclosed to.

Section 31 lets a data subject or any other person complain to the Authority in the prescribed manner that a data collector, processor or controller is infringing their rights or violating the Act, and lets a data collector, processor or controller itself complain to the Authority in writing about a violation or non-compliance.

Section 32 requires the Authority to investigate every complaint and lets it direct a data collector, processor or controller to remedy a breach or take other action to restore the integrity of the data or the data subject's rights.

Section 33 gives a data subject who suffers damage or distress through a contravention of the Act a right to apply to a court of competent jurisdiction for compensation from the data collector, processor or controller responsible, a private right of action, subject to the defence that the person took reasonable care to comply. Section 34 lets a person aggrieved by an Authority decision appeal to the Minister within thirty days, with a copy of the appeal going to the Authority.

Sections 35 to 37 make it an offence to unlawfully obtain, disclose or procure the disclosure of personal data, to unlawfully destroy, delete, mislead, conceal or alter it, or to sell or offer to sell it, each punishable on conviction by a fine of two hundred and forty to two hundred and forty five currency points (twenty thousand Uganda shillings per currency point) or imprisonment of up to ten years, or both.

Section 38 extends those offences to a corporation and to any officer who knowingly and wilfully authorises or permits the contravention, and lets a court additionally fine a convicted corporation up to two percent of its annual gross turnover, having regard to the gravity and impact of the offence.

Section 8 bars a person from collecting or processing a child's personal data unless it is carried out with the prior consent of the child's parent, guardian or another person with authority to decide for the child, or is necessary to comply with the law, or is for research or statistical purposes.

Section 9(1) bars a person from collecting or processing personal data relating to an individual's religious or philosophical beliefs, political opinion, sexual life, financial information, or health status or medical records, and section 9(2) exempts information collected under the Uganda Bureau of Statistics Act from that bar.

Section 9(3) permits collection or processing of that special personal data only where it is exercised or performed under a right or obligation a law imposes on an employer, where the data subject gives it freely and with consent, or where a non-profit political, philosophical, religious or trade union body collects or processes it for its own legitimate activities about its own members or regular contacts and does not disclose it to a third party without the data subject's consent.

The enumerated special-category list does not name biometric or genetic data, so a biometric identifier is not treated as special personal data under this Act.

Section 14 permits the fair use of a protected work, without the copyright owner's consent, for private personal use, for a quotation from a published work (including a newspaper or periodical press summary) that is compatible with fair practice and acknowledges its source, for teaching purposes to the extent justified by way of illustration, for reproduction or communication of a work that can be seen or heard to the extent justified for the purpose when reporting on current events, and, since the Copyright and Neighbouring Rights (Amendment) Act, 2026, for use of a work in an online learning environment by an education institution, library, archive or museum.

Section 5 excludes ideas, concepts, procedures and methods from copyright protection outright, and section 6 excludes an enactment, a court decision, a government inquiry report, and the news of the day (reports of fresh events or current information by the media, whether published in written form, broadcast, on the internet, or by any other means) from copyright protection, holding the Government as trustee of those works for the public benefit.

The Act contains no text-and-data-mining exception and confers no sui generis database right; a compilation is protected, if at all, only as an ordinary literary work under section 4, and Uganda's related (neighbouring) rights cover only performances, sound recordings, broadcasts and programme-carrying signals.

Unauthorised publication, distribution, reproduction, public performance, broadcast, or communication of a protected work to the public is an offence under section 46(1), which since 22 May 2026 carries a fine of up to 2,500 currency points (UGX 50,000,000) or imprisonment of up to ten years, or both.

Regulation 32 requires a licensee to put in place a risk management framework with measures to mitigate the risks that arise in the operation and provision of payment system services. Regulation 32 also requires a licensee to comply with the risk management requirements, including technical standards, that the Bank of Uganda or another competent authority issues through guidelines or directives.

Regulation 22(4) requires an electronic money issuer to notify the Bank of Uganda in writing no later than twenty-four hours from the occurrence of suspected or confirmed fraud relating to the electronic money service, security breaches, material service interruption or other significant issues that may affect its safety and efficiency. The same paragraph requires notice within the same period of a loss of confidential data.

Regulation 22(8) makes a licensee that fails to comply with regulation 22 without reasonable cause liable to a civil penalty of two hundred currency points per day of default.

Section 6(1)(d) excludes the news of the day, meaning reports of fresh events or current information by the media whether published in written form, broadcast, on the internet, or by any other means, from copyright protection outright, and section 6(2) makes the Government trustee of the excluded works for the public benefit: a bare news report is never a protected work under Ugandan law, whichever outlet reports it first.

Section 14(1)(b) separately lets any person, without the copyright owner's consent, quote a published work, including a quotation from a newspaper or periodical in the form of a press summary, where the quotation is compatible with fair practice, its extent does not exceed what is justified for the purpose of the work using it, and the source is acknowledged.

Neither provision is capped at a headline-length or short-extract threshold beyond fair practice and the quoting work's own purpose, and whether either reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a traditional press summary, has not been tested in a reported Ugandan decision.

Uganda has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognised hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.