Almost every Ugandan business collects personal data: customer phone numbers on WhatsApp, delivery addresses, employee National ID copies, patient records, student files, CCTV footage, mobile money transaction details. Under the Data Protection and Privacy Act, 2019, that information comes with legal responsibilities — and the regulator has made it clear that registration and compliance are not optional.
This guide explains, in practical terms, what the law expects from small and medium businesses and the steps to become compliant. It is general information, not legal advice; consult the Personal Data Protection Office (PDPO) or a lawyer for your specific situation.
- Organisations that collect or process personal data are required to register with the PDPO, and registration must be renewed annually.
- Collect only the data you need, for a clear purpose, with consent or another lawful basis.
- Keep data secure and report breaches to the PDPO.
- Customers and employees have rights to access and correct their data.
Who regulates data protection in Uganda?
The Personal Data Protection Office (PDPO), an independent office operating under the National Information Technology Authority–Uganda (NITA-U), was operationalised in 2021. It maintains the data protection register, handles complaints and enforces the Act. In a notable 2025 decision, the PDPO ruled that even a major multinational was required to register — confirming that the registration obligation applies to qualifying organisations regardless of size until specific exemptions are gazetted.
What counts as personal data?
Any information that identifies a person: names, phone numbers, emails, National ID numbers, photographs, addresses, financial details, health information, biometric data and more. Some categories — such as health, religious or financial information — are treated as special and need extra care.
Who must register?
Data collectors, data processors and data controllers are required to register with the PDPO. In practice, if your business keeps customer databases, employee records, CCTV recordings, membership lists or patient and student records, you should assume registration applies to you. Registration is renewed every year.
Core principles to follow
- Lawful collection and consent. Collect data for a lawful purpose, and obtain consent where required.
- Purpose limitation. Use data only for the purpose you collected it for.
- Data minimisation. Collect only what you need. Does a printing customer really need to leave a copy of their ID?
- Accuracy. Keep data correct and up to date.
- Retention. Don’t keep data longer than necessary; delete or anonymise it afterwards.
- Security. Protect data against loss, theft and unauthorised access.
- Transparency. Tell people what you collect and why.
A practical compliance checklist for SMEs
| Action | How |
|---|---|
| Map your data | List what personal data you hold, where (phones, laptops, paper files, cloud), and who can access it. |
| Register with the PDPO | Complete the registration with the PDPO and diarise the annual renewal. |
| Publish a privacy notice | On your website, forms and premises: what you collect, why, how long, and how people can contact you. |
| Update forms | Remove unnecessary fields; add consent checkboxes where needed. |
| Secure devices | Passwords, screen locks, encryption, updated software, backups. |
| Secure paper | Locked cabinets for ID copies, contracts and employee files; shred documents you no longer need. |
| Control access | Staff access only what they need; remove access when staff leave. |
| Check suppliers | IT providers, cloud services and payroll processors who handle your data should have proper safeguards. |
| Breach plan | Know what to do if data is lost or stolen, including notifying the PDPO. |
| Train staff | Short, practical sessions on handling customer data, WhatsApp etiquette and phishing. |
CCTV and signage
CCTV is common in Ugandan shops, offices and estates, and footage of identifiable people is personal data. Display clear signs that CCTV is in operation and why, restrict who can view recordings, and keep footage only as long as needed. Simple printed CCTV notices and privacy notice boards are inexpensive — sign makers and printers such as BrandAds Limited produce them on durable materials suitable for entrances and reception areas.
Marketing and WhatsApp
- Send marketing messages only to people who have agreed to receive them.
- Offer an easy opt-out, and honour it.
- Don’t share or sell customer lists.
- Don’t post customer photos or details on social media without permission.
See our WhatsApp Business guide for professional messaging practices.
Employee data
Employee records contain sensitive information: IDs, bank details, medical notes, disciplinary records. Store them securely, limit access to HR and management, and inform employees how their data is used. Our hiring guide covers related employer obligations.
Individuals’ rights
People can ask what data you hold about them, request corrections, and in some circumstances object to processing or ask for deletion. Designate someone to handle such requests and respond within a reasonable time.
Frequently asked questions
Does the law apply to small businesses?
Yes. The Act applies to organisations that collect or process personal data in Uganda, regardless of size, subject to any exemptions the PDPO may publish.
Is keeping customers’ numbers on WhatsApp “processing data”?
Yes — storing and using phone numbers for business is processing personal data. Use them only for legitimate business communication and protect the devices.
What happens if we don’t comply?
The PDPO can investigate complaints and issue orders, and the Act provides for penalties. Beyond legal risk, a data breach can seriously damage customer trust.