Adlegal International Limited v WhatsApp LLC and Meta Platforms, Inc.
Complaint upheld in part; declarations + 90-day remedial orders served as enforcement notice; cessation prayers declined. PDPO, 20 February 2026.
The facts
Adlegal International Limited complained in March 2025 that WhatsApp shares Ugandan users' personal data with Meta Platforms without freely given, informed and explicit consent, collects more data than necessary, gives Ugandan users materially weaker transparency than users in other jurisdictions, and transfers personal data out of Uganda without demonstrating compliance. The PDPO upheld the complaint in part, finding structural deficiencies in transparency, purpose specification, lawful-basis correlation and cross-border compliance demonstration, but declined the prayers for an immediate halt to all intra-group data sharing, holding the findings did not establish that all such sharing is unlawful or that users suffered demonstrable material injury.
Orders and outcome
Within ninety days WhatsApp must revise its Uganda-facing privacy policy to correlate data categories, purposes, lawful bases and recipients; structurally separate processing essential to core messaging from ancillary processing; submit a documented cross-border adequacy and safeguard assessment; and submit a data protection impact assessment of intra-group sharing plus a legitimate-interests assessment. The decision was served on the respondents as an enforcement notice, with daily fines for default. Dated the 20th day of February; the year on the scanned signature line is illegible.
Cite this decision
Track Uganda enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.