Uganda DPPA

Data Protection and Privacy Act 2019

Uganda's comprehensive data protection law requiring parental consent for children's data and immediate breach notification.

Jurisdiction

Uganda

Enacted

Feb 25, 2019

Effective

Aug 1, 2021

Enforcement

Personal Data Protection Office

Uganda Personal Data Protection Office

Why It Matters

Uganda's immediate breach notification (stricter than GDPR's 72 hours) and parental consent requirements create high compliance obligations for services targeting Ugandan youth.

At a Glance

Applies to

AI CompanionMental Health AppGeneral Chatbot

Requires

Transparency User Rights Data Minimization

Who Must Comply

Data controllers and processors in Uganda
Entities processing data of Ugandan residents
Automated systems processing personal data

Obligations fall on:

Safety Provisions

Children's data requires prior parental consent
Immediate breach notification required
Data Protection Officer mandatory for large-scale processing
Data Protection Impact Assessment for high-risk processing
Cross-border transfer restrictions

Compliance & Enforcement

Penalties

UGX 2.0B; criminal (up to 5yr)

Criminal liability

Primary Source

Uganda Personal Data Protection Office

https://www.pdpo.go.ug/

View on map

Uganda

Focus Areas

Mental health & crisis

Child safety

Cite This

APA

Uganda. (2019). Data Protection and Privacy Act 2019.

Related Regulations

In Effect ZM

Zambia DPA

Zambia's comprehensive data protection law with special protections for vulnerable persons and DPIA requirements for high-risk processing.

In Effect BW

Botswana DPA

Botswana's modernized data protection law requiring Data Protection Impact Assessment and establishing age 16 for consent.

In Effect SC

Seychelles DPA

Seychelles' modern data protection law requiring DPO for large-scale processing and recognizing Cross-Border Privacy Rules certification.

In Effect RW

First African country to adopt comprehensive national AI policy. Establishes Responsible AI Office (RAIO) under MINICT. Implements RURA ethical guidelines covering beneficence, non-maleficence, autonomy, justice, explicability, transparency. Non-binding framework.

In Effect CN

China CSL Amendments

First major revision of China's foundational Cybersecurity Law since 2017. Introduces formal AI governance provisions, significantly increases penalties, and expands extraterritorial application to all cybersecurity violations.

In Effect US-CA

CA SB 524

Requires law enforcement agencies to disclose when AI is used to write or assist in creating official police reports, maintain audit trails, and preserve AI-generated first drafts.

All regulations Check if this applies to you

Last updated January 22, 2026. Verify against primary sources before relying on this information.