Status
In force
Consent model
Opt-in
Primary law
Data Protection and Privacy Act 2019
Year
2019
Authority
Personal Data Protection Office (PDPO)
Marketing consent
Consent-first with listed exceptions; registration required.
Transfers
Transfers abroad need an adequate destination or the individual's consent.
Penalties
Fines and imprisonment; corporate fines tied to turnover percentages for some offenses.
The framework
Uganda's framework rests on the Data Protection and Privacy Act 2019, with the Personal Data Protection Office as the supervisory authority.
That puts Uganda in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Data Protection and Privacy Act 2019
2019 · In force
Uganda's PDPO has moved from setup to enforcement, publishing decisions on breaches and unlawful disclosure; registration of collectors and processors is the entry-level duty.
Marketing and advertising
Consent-first with listed exceptions; registration required. That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad need an adequate destination or the individual's consent.
Enforcement and penalties
Fines and imprisonment; corporate fines tied to turnover percentages for some offenses.
Cite this page: "Uganda Data Privacy Laws." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/uganda.html. Accessed [date].