Phillip Simbwa v Chipper Technologies Uganda Limited
Complaint dismissed in substance; direction to clarify privacy notice. PDPO, 12 March 2025.
The facts
The complainant asked Chipper Technologies Uganda Limited to delete his personally identifiable information and know-your-customer data. The company required him to cash out his account balance first and explained that KYC and transactional data could not be deleted because of a ten-year statutory retention obligation under anti-money-laundering law. The PDPO held the retention lawful and found no infringement of the right to deletion, while confirming that the company may not process or share the retained data for any purpose beyond regulatory compliance without his explicit consent, and remains obliged to delete it securely when the retention period ends.
Orders and outcome
The complaint was dismissed in substance. Chipper was directed to clarify in its privacy notice that processing or sharing retained personal data beyond compliance obligations requires prior explicit consent, with breach of the decision an offence attracting daily fines. Appeal lies to the Minister of ICT within thirty days. Dated 12 March 2025.
Cite this decision
Track Uganda enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.