Data-protection compliance in Uganda: checklist

Checklist Free Data & consumer Updated 9 June 2026 AI-generated

Pending verification: The current PDPO registration thresholds, fees and renewal cycle. Treat the flagged points as provisional and confirm them before relying on them.

In brief

If you collect personal data, the Data Protection and Privacy Act applies. This checklist covers registration, the principles and data-subject rights.

Who it's for & when to use it

Who it's for: Organisations that handle personal data, and their advisers.

When to use it: When building or auditing how you handle personal data.

When not to use it: As a substitute for a full data-protection impact assessment.

The checklist

1. Map your data

Map what personal data you hold, why, where it comes from and where it flows.
Identify the lawful basis for each processing purpose.

2. Register with the PDPO

3. Apply the principles

Process data lawfully, fairly and for a specified purpose; keep it accurate, secure and no longer than needed (Data Protection and Privacy Act).
Obtain consent or another lawful basis for processing.

4. Honour data-subject rights

Have a process to handle data-subject access and correction requests within time.
Publish a clear privacy notice.

5. Prepare for breaches

Have a breach-response and notification process, and train staff on it.

Key authorities

Data Protection and Privacy Act, Cap. 97 (2023 Revision).
Data Protection and Privacy Regulations, 2021.

Checklist · Data & consumer. Actively maintained. Last reviewed 9 June 2026; next review due 9 June 2027. This resource is a practitioner orientation and general information, not legal advice, and does not create an advocate–client relationship. It is AI-generated. Ugandan law changes and chapter and section numbers were revised in the 2023 Laws of Uganda. Verify every statute, rule, form, fee and authority against the current primary source — and the specific facts of your matter — before relying on it.