WhatsApp LLC and Meta Platforms, Inc.

Complaint upheld in part; declarations + 90-day remedial orders served as enforcement notice; cessation prayers declined. PDPO, 20 February 2026.

Record ID

ug-pdpo-2026-0001

Jurisdiction

Uganda

Regulator

PDPO

Type

enforcement notice

Date decided

20 February 2026

Respondent type

private

Sector

technology

Violations

breach of data minimisation (ancillary analytics), transparency and lawful-basis correlation deficiencies, differential transparency for Ugandan users, failure to demonstrate cross-border transfer compliance

Provisions cited

s.3(1)(c) DPPA Cap 97, s.14 DPPA Cap 97, s.19 DPPA Cap 97, Reg 30 DPP Regulations 2021, Reg 45(2) DPP Regulations 2021

Outcome

complaint upheld in part; declarations + 90-day remedial orders served as enforcement notice; cessation prayers declined

Status

final

Source

Official document ↗

Record verified

11 July 2026

Summary

On a complaint by AdLegal International Limited, the PDPO declared that while WhatsApp's core messaging processing is proportionate, certain ancillary analytics and ecosystem-integration processing breach data minimisation, that structural transparency deficiencies impaired informed user control, that Ugandan users receive reduced substantive protection versus other jurisdictions, and that cross-border compliance was not demonstrated. Within 90 days WhatsApp must revise its Uganda-facing privacy policy to correlate data categories, purposes, lawful bases and recipients; structurally separate essential from ancillary processing; submit a Regulation 30 adequacy and safeguards assessment; and file a DPIA on intra-group sharing. The PDPO declined orders to halt WhatsApp-Meta data sharing outright, and served the decision as an enforcement notice with daily fines for default. Decided 20 February 2026.

BIG-TECH · CROSS-BORDER-TRANSFER · TRANSPARENCY · DATA-MINIMISATION · DPIA · ENFORCEMENT-NOTICE

Cite this decision

Track Uganda enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.