Uganda's Data Protection and Privacy Act: A Practical Starting Point for SMEs
If you collect names, phone numbers or ID details from customers or staff, the Data Protection and Privacy Act applies to you. Here is where to begin.
The Data Protection and Privacy Act, 2019 sets out how organisations in Uganda must collect, use, store and share personal information. It applies to businesses of every size. If you keep customer phone numbers, employee records, national ID copies or photographs, you handle personal data.
What counts as personal data?
Any information that identifies a living person: names, phone numbers, addresses, ID numbers, photographs, financial information and CCTV footage. Some categories, such as health and children's data, need extra care.
The core principles
- Lawful and fair: collect data for a clear purpose and, in most cases, with the person's consent
- Minimal: collect only what you need
- Accurate: keep it up to date
- Secure: protect it from loss, misuse and unauthorised access
- Limited retention: do not keep it longer than necessary
Practical first steps
1. Map your data. List what personal data you hold, where it is kept (paper, spreadsheets, phones, cloud), who can access it and why you have it.
2. Register where required. Organisations that collect, process or control personal data are expected to register with the Personal Data Protection Office, which sits within NITA-U. Check the current requirements and fees.
3. Write a simple privacy notice. Tell people what you collect, why, who you share it with and how they can ask to see or correct it.
4. Secure it. Use passwords, restrict access, lock paper files and back up important data. Take care with WhatsApp groups that include customer information.
5. Plan for incidents. Decide who responds if data is lost or leaked, and how affected people and the regulator will be notified.
Why it matters commercially
Larger clients, banks and donors increasingly ask suppliers about data protection. Showing that you have it under control can help you win business as well as avoid penalties.
This article is general information, not legal advice. We help organisations assess their position and put practical policies in place; see our risk and compliance services.