Collection/processing in Uganda and processing of personal data of Ugandan citizens outside Uganda.
Key obligations
Principles of data protection (Part II); Consent-centred lawful bases; special rules for children and special-category data; Registration of collectors/processors/controllers with the PDPO (Regulations 2021)
DPO required
Institutions must designate a DPO where required under the 2021 Regulations.
Registration
Yes: register with the Personal Data Protection Office (2021 Regulations).
Cross-border transfers
Processing/storage outside Uganda requires adequacy of protection or data-subject consent (s.19).
Breach notification
Immediate notification to the Authority on reasonable belief of breach (s.23); subjects notified where directed.
Penalties
Offences fined per currency points and/or imprisonment up to 10 years; corporations liable up to 2% of annual gross turnover for certain offences.