Data Protection and Privacy Regulations

Regulation

and procedures

processing personal data

personal data

controllers and data processors

Al. Complaints against breach and noncompliance

Part X---GENERAL

A8. Failure to comply with notice

SCHEDULES

SCHEDULE 1-FORMS

Form | . Notice of Objection to Collection/Processing of Personal Data

Form 2 Application for Registration/Renewal of Registration

Form 3 Undertaking Not to Process or Store Personal Data Outside Uganda

Form 4 Certificate of Registration

Form 5 Application for Certified Copy of Extract/Entry in Register -

Form 6 Complaint Concerning Processing Personal Data Without Appropriate Security Measures

Form 7 Notification of Data Breach

'Form 8 Request to Confirm Possession of Personal Data

Form9 Complaint Concerning Inaccurate Personal Data in the Possession of Data Controller

Form 10 Decision On Complaint in Respect of Inaccurate Personal Data in the Possession of Data Controller

Form 11 Complaint Concerning Infringement or Violation of the Act

Form 12 Decision of the Office on Compliant Concerning Infringement or Violation of the Act

Form 13 Appeal

Form 14 Decision of Minister on Appeal

SCHEDULE 2 - Fees

STATUTORY INSTRUMENTS

2021 No. 21.

The Data Protection and Privacy Regulations, 2021 (Under section 39 of the Data Protection and Privacy Act, 2019, Act 9 of 2019)

IN EXERCISE of the powers conferred upon the Minister by section 39 of the Data Protection and Privacy Act, 2019, and after consultation with the National Information Technology Authority - Uganda, these Regulations are made this 29th day of January, 2021.

These Regulations may be cited as the Data Protection and Privacy Regulations, 2021.

In these Regulations, unless the context otherwise requires-

In addition to the functions specified in section 5 of the Act, the Office shall-

In carrying out the functions specified under the Act, the Office may-

Management of Personal Data Protection Office

7, National Personal Data Protection Director (1) The Office shall be headed by a National Personal Data Protection Director appointed on such terms and conditions as may be specified in his or her instrument of appointment.

Subject to the general supervision and direction of the Board, the Director shall be responsible for-

Part I1J-Data COLLECTION AND PROCESSING

For the purposes of section 8 of the Act, every data collector, data processor and data controller shall establish a system to ascertain the age of persons whose personal data is to be collected, processed or stored, and where the data relates to a child, the manner of obtaining consent of a parent or legal guardian, where necessary.

Part [V-DATA PROTECTION REGISTER

register with Office . (1) Subject to subregulation (2), every data collector , data processor or data controller shall register with the Office. (2) The Office shall, in consultation with the Board, by notice in the Gazette, exempt certain data collectors, data processors or data controllers from the requirement to register with the Office.

G) specify the details of the data protection officer, if any;

Procedure for considering application

Grant or refusal of registration -

A registration shall be valid for twelve months from the date of registration.

A data collector, data processor or data controller in respect of whom an entry is made in the Register shall notify the Office in writing of any change in the registered particulars of the data collector, data processor or data controller within fourteen days of the occurrence of the change. | 728

, (3) Where the data controller is satisfied with the request under subregulation (1), the data controller shall in accordance with section 16(2) of the Act, comply with the request.

procedures (1) For the purposes of section 20(3) of the Act, the Office shall publish, in the Gazette, the generally accepted information security practices and procedures and specific industry professional rules and regulations applicable to the security of personal data. (2) Information security practices and procedures and specific industry professional rules and regulations applicable to the security of personal data referred to in subregulation (1) include- (a) administrative measures, that is to say, measures aimed at creating efficient guidelines and security standards for dealing with personal data;

_ (3) The complaint shall be in Form 6 in Schedule 1. (4) The complaint shall be handled in accordance with the complaints procedure specified in the Act and these Regulations.

data (1) Where a data processor or data controller notifies the data subject of his or her intention to continue processing personal data for the purpose of direct marketing, the data subject may within fourteen days of receiving the notice request the Office in writing to review the decision of the data controller or data processor.

data (1) Where a data subject believes that a data controller holds inaccurate personal data about the data subject, the data subject may request, in writing, the data controller to rectify, block, erase and destroy that personal data.

data controllers Every data collector, data controller and data processor shall develop and implement a complaints handling system to deal with complaints from data subjects.

44, Director may seek assistance in investigation For the purpose of gathering information or for the proper conduct of any investigation under these regulations, the Director may seek the assistance of any person or authority.

A person who fails to comply with any notice issued by the Office under these regulations commits an offence and is liable, on conviction, to a fine of not exceeding three currency points for each day in default of the notice or to imprisonment not exceeding six months or both.

Every data collector, data processor and data controller registered under these Regulations, shall within ninety days after the end of every financial year, submit to the Office a summary of-_ (a) all complaints received and the status of such complaints, including whether the complaint was resolved or is still pending; and

SCHEDULE 1

Regulation 10(5), 23(3) FORM 1

NOTICE OF OBJECTION TO COLLECTION/PROCESSING OF PERSONAL DATA

| rrtec e cence deene eee ene ene enna es (insert full name and address of data subject), wish to withdraw my consent for the collection/processing (whichever is applicable) of the personal data provided to the Data Collector/ Data Processor/Data Controller (whichever is applicable) for:

° All the purposes I had provided my consent for; or

° For only the following purposes bocce eee tenes eeaee teens

State purpose of objection to collection/processing of personal data...

[ fully understand and agree that the withdrawal of my consent to any or all purposes, depending on the nature of my request, may result tn the Data Collector/ Data Processor/Data Controller, not beingin a position to continue to provide services to me.

Signature of data subject............. bese aeeeeues beeeceuee

Regulation 16(1)

FORM 2 |

APPLICATION FOR REGISTRATION/RENEWAL OF REGISTRATION

To: The Personal Data Protection Office Kampala

APPLICATION FOR REGISTRATION/RENEWAL OF REGISTRATION

Data Collector/Data Processor/Data Controller (tick whichever is applicable)

l. Details of applicant

or processed (be detailed as nena een ees POSSIBLE) oo. ieee erence

AS POSSIDI) oo. eee Ete i If you are an individual or sole trader. give your surname and first name(s). A partnership must include the name of the firm and the names of each of the partners. In the case of a corporation, the name of the corporation must be given. 2 Please provide a general. but comprehensive. statement of the nature of your business. trade or profession. and of the purpose for which you keep and process personal data. NOTE: Please note that where personal data is kept for two or more purposes. a separate application for registration in respect of any of those purposes must be made as per section 29(2) of the Act.

personal data may be disclosed and purpose for disclosure?............ cece cece cece ce eee eee eee ener ees

to, purpose of transfer and brief description of data transferred*....... 0.0... cece cece cece eee ener ee ees

safeguard data collected or PLOCESSe" 2... cece eee een n een ere e ene E ee

were ee ee ERR eRe HERE EMO EO ORO EEE eee HERERO Oo T em HME eRe EEE EEE Ee EE TEESE TERE EEE

or store personal data in a country outside Uganda unless such country has adequate measures in place, at least equivalent to the protection provided for by the Act, for the protection of the personal data and the data subject consent to the transfer.

Office ...............0..8 I certify that the above information is correct and complete and hereby apply to be registered as data collector/data processor/data controller under the Data Protection and Privacy Act.

Signature Of Applicant: ......0. 0.00 c ccc cence eee nent center rene:

Dye] Sarre (*Applicant/Person authorised to sign on behalf of Applicant) (*Delete whichever is not applicable)

NOTES:

"Registration Classification and Guidance Notes for Application" before completing this form.

a data collector, data processor or data controller who is required to be registered under the Data Protection and Privacy Act. 3 4+ For each application listed. list the countries or territories (if any) to which you uansfer. or intend to transfer. personal data directly or indirectly. along with a description of the data to be transferred and the purpose of transfer.

Please complete this form in BLOCK CAPITALS.

Failure to register or renew registration is an offence under the Data Protection and Privacy Act, 2019.

Knowingly giving false information is an offence under the Data Protection and Privacy Act.

It is also an offence to knowingly-

Where you change your address, you must notify the Office within 15 days of the change of address. |

The information provided by you in this application will be kept in a register by the Director, in accordance with section 29 of the Data Protection and Privacy Act, 2019 and will comprise the Register which may be inspected by members of the public at any time.

Regulation 16(4) FORM 3

UNDERTAKING NOT TO PROCESS OR STORE PERSONAL DATA OUTSIDE UGANDA

| ree (insertfullname and address ofapplicant) undertake not to process or store personal data in a country outside Uganda unless such country has adequate measures in place for the protection of personal data at least equivalent to the protection provided for by the Act or permitted under the Act and Regulations made under the Act.

Dated this ............. day Of oe eeeeeeeeeeeteeeeeeeeey 20 vee

a 2 ee

ee a)

Signature ofperson making undertaking

Before me

Ce ee ee

Commissioner for Oath

Regulation 19(2)

FORM 4

CERTIFICATE OF REGISTRATION

I CERTIFY THAT ...... 0.0... ccc cece eeneeeeeeeeneeaees (insert name of company, individual or public body) has this day been registered as

bocce ceeeeeeeeeeeeeeeeeeeeneaes (insert category: data collector/data processor/ data controller) under the Data Protection and Privacy Act, 2019 under the

following registration number...................0.c.ccceeeeee eee eeeees

This certificate is valid for twelve months from the date of issue.

Dated this......... day of............... the year...0c cece ee

Se as

National Personal Data Protection Director

Regulation 28(3) FORM 5

APPLICATION FOR CERTIFIED COPY OF EXTRACT/ENTRY IN REGISTER

Record of Copy of Extract/Entry in Register...................0.0008

Registration Particulars:

Registration Number.................. 0 cece cece cece econ ene eee ee nase enna neaenens

Purpose of Extract/Entry in Register

Date of Application................c ccc cece ccc e eect net e ete tee e eee e eee eneeneae ees

Particulars of Applicant: .............. ccc ccc cece eee eee e eee ee neat teen eget anes

Telephone Number....................Denne ence eee e nant eee eta e tebe eee een eE

E-Mail Address.................. Pee EEE SEEEEEEE

Place of work/Address.................cccecce eee cne cece eee eeeeeeeeeeeneeeeenaeeees

Comments by Records Offficer............ see cceeeeeeeeetee tere nneee nee eeeeennenes

Comments by Office...... 0. cc eee e cece eee cere ena e ence teeta en ne eee neaens

Date of application: ............ ccc ccc cece ene cece eee ee ee eee eee ene e ee eneena tenis

Signature ofApplicant ............0..c000 0s vote ne eee teeta en scene sees ee teeeeeaenene ety

Regulation 32(3)

FORM 6

COMPLAINT CONCERNING PROCESSING PERSONAL DATA WITHOUT APPROPRIATE SECURITY MEASURES

DETAILS OF PERSON MAKING COMPLAINT First Name:

Last Name:

Address:

E-mail address:

Phone Number:

DETAILS OF COMPLAINT

My complaint is against: (name of person, institution, or public body against whom complaint is being made)

Address of person making complaint: (please provide full address of person making complaint)

I have been dealing with: (institution, or public body against whom complaint is being made)

Date:

Nature of complaint (provide full details of complaint)

of person making Complaint: ............:ceeeveeente neers Signature:

Regulation 33(2) FORM 7

NOTIFICATION OF DATA BREACH

First Name:

Last Name:

Address:

E-mail address:

Phone Number:

When did the breach happen?

b) How did the breach happen? Cc) If there has been a delay in reporting the breach please explain the reasons for this

d) What measures were in place to prevent an breach of this nature occurring? . Please provide extracts from any policies or procedures considered relevant to this breach, and explain which of these were in existence at the time of this breach. Please provide the dates on which they were implemented.

Personal data placed at risk

f) What personal data has been placed at risk? Please specify if any financial or sensitive personal data (special categories*) has been affected and provide details of the extent.

g) How many data subjects have been affected and how many data records are involved?

h) Are the affected individuals aware that the breach has occurred? i) What are the potential consequences and adverse effects on those individuals?

j) Have any affected individuals complained to the University about the breach?

Containment and recovery k) Has any action been taken to minimise/mi tigate the effect on the affected data . subjects? If so, please provide details 1) Has the data placed at risk now been recovered? If so, please provide details of how and when this occurred. | m) What steps have been taken to prevent a recurrence of this breach?

Miscellaneous n) Have the police or any other regulatory bodies been informed about 'this breach?

o) Has there been any media coverage of the breach?

* Special Categories of Personal data include: The racial or ethnic origin of the data subject Their political opinions Their religious or philosophical beliefs Whether they are a member of a trade union Their genetic data Biometric data used to uniquely identify them Their physical or mental health or condition ooooomooo Their sex life or sexual orientation

nett: Signature ofperson making NOLIPICALION; 2.62. cc ee ee eee ee eee

Regulation 35(1) FORM 8

REQUEST TO CONFIRM POSSESSION OF PERSONAL DATA

Name of data subject:

Data subjects National Identification Number/Passport/Driver's License/Aliens Identification card: 0c. ccc cee eee eee eee eee ......... ... eens

Data subject's email: ...................0. loc ce cece eee eeeeeeeeeeeneenenees

Data subject's phone number(s): ...............ce eee eee ceeeee ene ee es

Name of the data processor/controller from whom information is being requested: 2 2 2 ac

a

Description of personal data on data subject held by data processor/ controller (include the categories of data, purposes ofprocessing data, third parties the personal data may have disclosed to periodfor which the data has been held): ........... vec e ee base ea ee eee seca eteeeeeaeeeneeeeeeens

Relevant period of information: ...................... be ecee ee eeeenenenaees

68 TO) COL cece ccceccncccccccceecenvseecenees

Preferred form of access: hard copy/ soft copy (tick appropriately) . (Attach further details in an attached separate sheet, if necessary)

Signature: 2.0.0... cece cece eee eee ee eee ene teens nen ee na ees (signature of data subject or person authorised to act on behalf data subject)

OO Regulation 39(3) FORM 9

COMPLAINT CONCERNING INACCURATE PERSONAL DATA IN THE POSSESSION OF DATA CONTROLLER .

DETAILS OF PERSON MAKING COMPLAINT be

'First Name:

Last Name:

Address:

E-mail address:

Phone Number:

DETAILS OF COMPLAINT

My complaint is against: (name of person, institution, or public body against whom complaint is being made)

Address of person making complaint: (please provide full address of person making complaint)

I have been dealing with: (institution, or public body against whom complaint is being made)

Date:

Nature of complaint (provide full details of complaint)

Regulation 39/5) FORM 10

DECISION ON COMPLAINT IN RESPECT OF INACCURATE PERSONAL DATA IN THE POSSESSION OF DATA CONTROLLER

TO! ccc ccc cee enter rene een etn e ene t beeen nents (insert details ofperson making complaint)

Having reviewed your complaint lodged with the Personal Data Protection Office on ............... day of ................... 20..., concerning been eee nee ne ene eee tee tee beeen tenes ena es (insert brief details relating to complaint) the decision of the Office is as follows:

Pe ee

er ee a ee ae

National Personal Data Protection Director

Regulation 41(2)

FORM 11

COMPLAINT CONCERNING INFRINGEMENT OR VIOLATION OF THE ACT

DETAILS OF PERSON MAKING COMPLAINT

First Name:

Last Name:

Address:

E-mail address: | Phone Number:

DETAILS OF COMPLAINT

My complaint is against: (name ofperson, institution, or public body against whom complaint is being made)

Address of person making complaint: (please provide full address of person making complaint)

I have been dealing with: (institution, or public body against whom complaint is being made)

Date:

Nature of complaint (provide full details of complaint)

Regulation 45(2) FORM 12

DECISION OF THE OFFICE ON COM PLIANT CONCERNING INFRINGEMENT OR VIOLATION OF THE ACT

(insert details ofperson making complaint)

Having reviewed your complaint lodged with the Personal Data Protection Office on .......... day Of cooccecccccceeccceee. 20... eee. ,

CONCEMING oo. ec ec ec eceeeeesuceceeeececs (insert brief details relating to complaint) the decision of the Office is as follows:

Ween eae eee eect ete e eae teas tease eebivanee ennesenenees (insert details of decision)

a

National Personal Data Protection Director

Regulation 46(1)

FORM 13

APPEAL

TO: PERMANENT SECRETARY OF MINISTRY FOR INFORMATION AND COMMUNICATIONS TECHNOLOGY

APPEAL

bee e ee eee nese eeeeaees (insert name) being dissatisfied with the decision of the

Personal Data Protection Office made on the ....... day of ....... 20......

in respect Of 1.0... 6. cece eee eee e ene entrees eee neces (insert decision of the Personal Data Protection Office and copy of the decision) hereby apply to the Minister to review the decision. |

The reasonis for the appeal are as follows:

a

Dated this ...............:0..ceeeee eee C0) 20...

ee

Name and signature of person appealing (insert name and designation of the person making application)

Regulation 46(7)

FORM 14

DECISION OF MINISTER

(insert details ofperson making the appeal)

.DECISION OF MINISTER ON APPEAL

Having reviewed your appeal, lodged with the Ministry responsible for Information and Communications Technology on ..... day of ..... 20..., my decision is as follows:

TRE RR eR ERE Ree tee tee eee eee eee eee ee eee e ee ee et ee nee tnceesaeeteeenuc as

TR Te Ree Re tee ee ee enema e mae ee eee ean ee eee eae ete e antec ee eeeettaaaveeuens

a

Minister ofInformation and Communications Lechnology

SCHEDULE 2

Regulation 16(1), 28(2),

_ FEES

No. | Description offee Uganda Shillings

Register (one copy)

JUDITH NABAKOOBA (MP), Minister of Information Communications and Telecommunications and National Guidance.

Printed by Uganda Printing and Publishing Corporation