The PDPO declared Google LLC a data controller and collector under the Data Protection and Privacy Act, Cap 97, found its non-registration a violation of section 29 and Regulation 15, and found its cross-border transfers of Ugandan users' data without demonstrated safeguards in breach of section 19 and Regulation 30. Google was ordered to register with the PDPO within 30 days, designate a DPO, and submit documentary evidence of its cross-border compliance framework; no data-localisation order was made, and compensation claims were left to the courts under section 33(1).
PDPO (Uganda), Complaint No. 08/11/24/6683, determination of 18 July 2025. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/uganda/pdpo/2025/google-llc-registration-cross-border/ (accessed 22 July 2026).