Data protection

Uganda's Data Protection and Privacy Act, 2019 (now revised as Cap. 97) was assented to on 25 February 2019 and commenced on 3 May 2019, with its implementing Regulations effective 12 March 2021.

Official depository metadata (ULII) and DLA Piper handbook agree. Conflict resolved: Legal500 states commencement 1 March 2019 - rejected as a secondary-source error; the gazette date 3 May 2019 controls.

The Act applies extraterritorially: it covers a person, institution or public body outside Uganda who collects, processes, holds or uses personal data relating to Ugandan citizens (s.1).

CIPESA quotes the statutory text; DLA Piper reports the PDPO's own confirmation. Statute text capture-pending (ULII gate) - state self-upgrades on full-text capture.

Every data collector, processor or controller must register with the Personal Data Protection Office (s.29) and renew registration annually; the duty applies to foreign entities handling Ugandans' personal data until an exemption is gazetted.

Duty-level claim verified by two independent reports of the PDPO decision and the statute. Fee/portal mechanics deliberately split into UG-DP-C4 (weaker evidence).

Registration is completed online via the PDPO portal (Form 2 application plus Form 3 cross-border undertaking), fee UGX 100,000, typically 4-7 working days for initial registration.

Single Tier-3 source; the PDPO portal itself (pdpo.go.ug/register) was unreachable on 2026-09-22. Verify fees/SLA against the portal or the Regulations before citing operationally. Editorial ruling 2026-09-22 (delegated): kept split from UG-DP-C3 - the legal duty and the operational mechanics have different evidence bases and upgrade paths; folding would misdescribe the duty's verified position.

Cross-border transfer or storage of personal data outside Uganda requires either data-subject consent or adequate protection in the recipient country at least equivalent to the Act (s.19); no advance approval per transfer is required, but records of the legal basis and safeguards must be maintained and produced on audit.

s.19 text quoted by CIPESA; the no-pre-approval clarification is the PDPO's own position reported by DLA Piper. Material to colocation operators serving cross-border workloads (e.g. Kampala-Nairobi replication paths).

In a decision of 18 July 2025 (Ssekamwa Frank & 3 Others v Google LLC, Complaint No. 08/11/24/6683), the PDPO found Google LLC in breach of ss.29 and 19 and ordered registration, designation of a data protection officer, and production of a cross-border transfer compliance framework within 30 days - confirming the Act reaches foreign entities with no physical presence in Uganda.

Primary instrument (the decision itself) is capture-pending - not published on the regulator site; two independent reports agree on the findings and the complaint number. If either report is later contradicted, this claim degrades.

Rwanda's data protection law is Law No 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, officially gazetted on 15 October 2021.

Official gazette PDF captured (82pp bilingual, header 'Official Gazette n° Special of 15/10/2021'); RISA page and DataGuidance corroborate.

A person who intends to be a data controller or a data processor must register with the supervisory authority (Art. 29).

Verbatim captured. Practice detail: registration administered through the NCSA/DPO; transitional compliance window ended 15 October 2023 (RW-DP-C6).

Cross-border sharing or transfer of personal data outside Rwanda is permitted only if the controller/processor has (1) obtained authorisation from the supervisory authority after providing proof of appropriate safeguards, or (2) the data subject's consent, or (3) necessity grounds (contract performance, public interest, legal claims, vital interests) (Art. 48).

Verbatim captured from the official gazette text. MATERIAL DIFFERENCE vs Uganda: Uganda's PDPO confirmed no advance approval is required (records-based regime; UG-DP-C5). Rwanda requires prior authorisation as the first branch.

The National Cyber Security Authority (NCSA) is the designated supervisory authority under the Data Protection Law, and the Data Protection and Privacy Office (DPO) administers registration and authorisations under it.

DataGuidance names NCSA as designated supervisory authority; the official DPO site shows registration 'with NCSA' and the authorisation services. The law text itself uses the generic term 'supervisory authority'.

The transitional period for data controller/processor registration ended on 15 October 2023, after which registration became mandatory without the transition window.

Transition-deadline fact (15 Oct 2023) remains snippet-sourced (NCSA T1 snippet + DLA Piper T3). Capture mission 2026-09-22 added the operative T1: DPO registration services page confirms mandatory controller/processor registration is actively operated. Upgrade path: capture an NCSA/DPO announcement or gazette notice restating the transition-end date.

Tanzania's data protection law is the Personal Data Protection Act, 2022 (Act No 11 of 2022, GN No 395B), which establishes the Personal Data Protection Commission as a body corporate; regulator service pages now cite it as Chapter 44 (revised laws).

Full official Act PDF captured from the regulator itself (42pp): '6.-(1) There is established a Commission to be known as the Personal Data Protection Commission.'

Registration is a strict precondition for processing: 'A person shall not collect or process personal data without being registered as a data controller or a data processor under this Act' (s.14(1)).

Verbatim from the captured official PDF. Directly operator-material: a Tanzanian data centre's processing activities fall inside this duty.

Registration mechanics (Regulations GN 449C): application on Form No. 1 with fees per the Second Schedule; the Commission verifies within seven days; rejection must be notified with reasons within fourteen days; registration is valid for five years; renewal is on Form No. 3, submitted within three months before expiry.

Verbatim captured (Regs 4-8).

Registration fees are tiered by scale (Second Schedule, TZS): small-scale (1-49 employees, turnover below TZS 100M) TZS 100,000 once / 50,000 renewal; medium (50-99 employees, TZS 100-500M) 200,000 / 150,000; large-scale (100+ employees, turnover above TZS 500M) 1,000,000 / 500,000 - renewal after every 5 years.

Fee table verbatim captured. A typical commercial DC operator registers at the large-scale band.

Transfers to states with adequate protection (s.31): the Commission may prohibit transfer of personal data to a place outside the country; transfers to an adequate legal framework require necessity, the recipient to ensure safeguards, and a provisional evaluation of necessity by the controller.

Verbatim captured.

Penalty scale (Part VII): for offence classes such as unlawful disclosure, destruction, deletion, concealment or alteration of personal data, an individual is liable to a fine of TZS 100,000 to 20,000,000 or imprisonment up to ten years, and a company or corporation to a fine of TZS 1,000,000 to 5,000,000,000; registration-related false information carries TZS 100,000 to 5,000,000 or up to two years.

Verbatim captured (ss.60-61 and s.19/s.63 cross-reference). The TZS 5 billion corporate ceiling is among the region's sharpest exposure figures.

Kenya's data protection law is the Data Protection Act, 2019, and the Office of the Data Protection Commissioner (ODPC) is its supervisory authority, with the Act applying to data controllers and processors and conferring rights on data subjects.

Regulator's own site (T1 captured) states the DPA's scope and the ODPC's role; DLA Piper global guide (T3) corroborates. Act full text pending (Kenya Law JS shell) - section-level citations upgrade on capture.

Registration with the ODPC is mandatory for data controllers and processors, and the ODPC operates a live public register of registered data handlers showing registration numbers, handler type, county and Active/Expired status.

Two T1 captures from the regulator: the 'Register as a Data Handler' gateway plus the live register (57k chars of rows, INST-... numbers). Registration regime demonstrably operated, not merely enacted.