Uganda's Data Protection Law for Businesses

Uganda's Data Protection and Privacy Act, 2019 (DPPA) is the country's first comprehensive data protection law. It applies to every business, organisation and government body that collects, stores or processes personal data, from customer phone numbers and emails to employee records. Non-compliance carries fines and reputational damage. Here is what you need to know.

What is "personal data" under Ugandan law?

The DPPA defines personal data broadly, any information that can identify an individual, directly or indirectly. This includes:

• Name, address, phone number, email
• National ID number (NIN), passport number
• Date of birth, gender, marital status
• Financial information (bank account, mobile money number, transaction history)
• Location data, IP addresses
• Photos, videos, biometric data (fingerprints, facial recognition)
• Health information, employment records

If your business collects any of this, the DPPA applies to you.

Key obligations for businesses

1. You must have a lawful basis for collecting data

The DPPA recognises several lawful bases: consent (the person agreed), contract (you need the data to fulfil a contract), legal obligation (the law requires it), legitimate interest (you have a valid business reason that does not override the person's rights). For most businesses, consent is the safest basis, get clear, informed permission before collecting data.

2. You must tell people what you are doing

When you collect data, you must inform the person: who is collecting it, why, how it will be used, who it may be shared with, how long it will be kept and that they have the right to access and correct it. This is typically done through a privacy policy, a document on your website and available at your physical location.

Need a privacy policy for your website? TFast builds professional websites with compliant privacy policies included.

3. You can only collect what you need

The principle of data minimisation, do not collect data "just in case." If you run a retail shop, you need a customer's phone number for delivery, but you do not need their date of birth or marital status. Every extra piece of data is a liability, if you do not have it, you cannot lose it in a breach.

4. You must protect the data

You are required to implement "appropriate technical and organisational measures" to protect personal data. For a small business, this means at minimum:

• Access control: only staff who need the data can access it. The cashier does not need the full customer database.
• Encryption: sensitive data should be encrypted. Passwords must be hashed, never stored in plain text.
• Secure storage: databases behind firewalls, paper records in locked cabinets.
• Staff training: your team must understand basic data security.
• Regular updates: keep software, plugins and systems updated with security patches.

See our cybersecurity basics guide for small businesses for practical implementation steps.

5. You must report breaches

If personal data is lost, stolen or accessed without authorisation, you must notify the National Information Technology Authority (NITA-U) and, in serious cases, the affected individuals. "I did not know about the breach" is not a defence. You are expected to have systems to detect one.

6. People have rights over their data

Under the DPPA, individuals have the right to:

• Access their data, know what you hold and how you use it.
• Correct inaccurate data.
• Object to processing in certain circumstances.
• Withdraw consent and request deletion (with some exceptions for legal obligations).

If a customer asks what data you hold on them, you must respond. If a former customer asks you to delete their data (and no legal reason requires you to keep it), you must comply.

What about the Personal Data Protection Office?

The DPPA established the Personal Data Protection Office (PDPO) under NITA-U. As of 2025, the office is building enforcement capacity. Registration requirements for data collectors and processors are expected to be formalised. Businesses should proactively comply rather than wait for enforcement actions.

Cross-border data transfers

If you store data on servers outside Uganda (e.g., using a US-based cloud provider), the DPPA restricts these transfers unless the recipient country has "adequate" data protection or you have specific consent from the data subject. For most small businesses using standard cloud services (Google, Microsoft, AWS), this is manageable but should be disclosed in your privacy policy.

Practical compliance checklist for Ugandan businesses

• Have a written privacy policy, publicly available (on your website and/or in your shop).
• Collect only data you genuinely need.
• Get clear consent before collecting data (a checkbox saying "I agree to receive communications" counts).
• Store data securely, encrypted where sensitive, access-controlled everywhere.
• Train staff on basic data protection (do not share customer lists, do not leave files open on screens).
• Have a process for handling data access and deletion requests.
• Know how to detect and report a breach.

Does this apply to small businesses too?

Yes. The DPPA does not exempt small businesses. A salon that keeps a WhatsApp list of clients, a school with a student database, a SACCO with member records, all are covered. The good news: compliance for small businesses is simpler. A clear privacy policy, secure storage and staff awareness go a long way.

TFast Digital Agency builds secure, compliant websites and business systems with data protection built in, not bolted on as an afterthought. From encrypted databases to privacy policy pages, we help Ugandan businesses meet their obligations while building customer trust.

<!-- SEO keyword optimization: data protection uganda business -->

Focusing on data protection uganda business is essential for modern business success.