Data protection
The Data Protection and Privacy Act 2019 gives rights of access and correction, overseen by the Personal Data Protection Office.
Protection rests on the Data Protection and Privacy Act 2019 and its 2021 regulations, overseen by the Personal Data Protection Office. Data collectors and processors must register with the Office, and the Act gives rights of access, correction and objection.
Key points
| Regulator | Personal Data Protection Office |
|---|---|
| Applies to government | Unlike several regional statutes, it binds public bodies |
| Offences | Unlawful obtaining or disclosure is criminal |
| Consent | The primary lawful basis under the Act |
In practice
- Complain to the Personal Data Protection Office; registration details are public.
- Where a public body is involved, consider the Human Rights Commission as well.
Where to go
- Personal Data Protection Office — complaints and guidance.
Worth knowing
The Act binds government bodies, which is unusual in the region. That makes it a genuine route against public sector data misuse.
The general article: Data protection · Compare with another country
Privacy
Article 27 of the Constitution protects privacy of person, home, correspondence and communication. The Data Protection and Privacy Act 2019 applies to government as well as private entities and is administered by the Personal Data Protection Office, established within the national IT authority.
Uganda's Constitution protects privacy of the person, home, correspondence and communication, and the Data Protection and Privacy Act of 2019 created rights of access and correction and a regulator within the national information technology authority. Alongside it, the Computer Misuse Act has been used against online publication, and amendments in 2022 drew criticism for provisions on unsolicited and malicious information.
Key points
| Constitution | Article 27 |
|---|---|
| Statute | Data Protection and Privacy Act 2019, applying to public and private bodies |
| Regulator | Personal Data Protection Office |
| Registration | Data collectors, controllers and processors must register |
| Offences | Unlawful obtaining or disclosure of personal data is criminal |
| Remedy | Complaint to the Office, and Article 50 enforcement in court |
| Applies to government | Public bodies are covered by the 2019 Act |
| Compensation | The Human Rights Commission can award it directly |
In practice
- Where a state agency is involved, the Human Rights Commission can award compensation without a court case.
Where to go
- Personal Data Protection Office.
- Uganda Human Rights Commission, which can award compensation.
- Legal Aid Service Providers Network.
Worth knowing
The Uganda Human Rights Commission can itself order compensation, which is unusual: for intrusions by state agencies it is often more effective than the courts. The Commission's power to award compensation is unusual and makes it the most effective route against state intrusion.
Frequently asked questions
What does the Data Protection and Privacy Act cover?
Lawful collection and processing of personal data, consent, rights of access and correction, security obligations and registration of data collectors with the regulator. It applies to public and private bodies and to processing of Ugandans' data outside the country.
Image rights
The Computer Misuse Act 2011, amended in 2022, covers offensive communication and related conduct, and the Anti-Pornography Act 2014 criminalises pornographic material. The Constitutional Court struck down parts of both statutes, and the Anti-Pornography Act in particular has been used against people whose own images were leaked.
Key points
| Computer Misuse Act | Amended in 2022; parts of earlier versions were struck down as unconstitutional |
|---|---|
| Anti-Pornography Act 2014 | Criminalises pornographic material; has been applied to victims |
| Data protection | Data Protection and Privacy Act 2019 applies to identifiable images |
| Constitution | Article 27 protects privacy of person and communication |
| Reporting | Uganda Police Force Cyber Crime Unit |
| Human rights | Uganda Human Rights Commission can award compensation |
| Legal risk to victims | The pornography legislation has been applied to people depicted in leaked images |
| Constitutional decisions | Parts of both statutes have been struck down |
| Legal aid | Organisations can advise before any report is made |
In practice
- Speak to a legal aid organisation before reporting: the risk profile here is different.
Where to go
- Uganda Police Force Cyber Crime Unit.
- Uganda Human Rights Commission.
- Women's rights organisations providing legal aid.
Worth knowing
Take advice before reporting. Because the pornography legislation has been used against people depicted in leaked images, a legal aid organisation should review your situation first. This is the one jurisdiction covered here where reporting can expose the victim to prosecution. Take advice first.
The general article: Image rights · Compare with another country
Speech and online harassment
The Computer Misuse Act, amended in 2022, criminalises offensive communication, though the courts struck down parts of it.
The framework rests on the Computer Misuse Act, amended in 2022, which criminalises offensive communication and unauthorised sharing of information, with provisions struck down in part by the courts. Civil defamation and the Press and Journalist Act also apply; free expression organisations monitor enforcement closely.
Key points
| Offensive communication | Struck down by the Constitutional Court in 2023 as unconstitutional |
|---|---|
| Computer Misuse Amendment 2022 | Added provisions on unsolicited and malicious information |
| Civil defamation | Available in the courts |
| Criminal defamation | Still in the penal code, though challenged |
In practice
- Where a charge relies on the struck-down provision, raise the constitutional decision immediately.
- For reputational harm, civil proceedings are the more reliable route.
Where to go
- Uganda Communications Commission.
- Chapter Four Uganda and Unwanted Witness for digital rights support.
Worth knowing
The offensive communication provision was struck down in 2023, but arrests under it have continued. The decision is binding and should be cited at once.
The general article: Speech and online harassment · Compare with another country
Copyright
The Copyright and Neighbouring Rights Act 2006 protects works for the author's life plus fifty years and provides for a register maintained by the Uganda Registration Services Bureau. Fair use is permitted for private study, research, criticism, review and reporting. Expressions of folklore are protected, with use requiring permission.
Uganda's Copyright and Neighbouring Rights Act protects works for the author's life plus fifty years, provides for registration with the Uganda Registration Services Bureau, and recognises folklore. Fair use style exceptions exist for research, private study, criticism and news reporting, drafted more broadly than the closed lists found in some other common-law jurisdictions.
Key points
| Statute | Copyright and Neighbouring Rights Act 2006 |
|---|---|
| Registration | Voluntary register at the Uganda Registration Services Bureau |
| Fair use | Private study, research, criticism, review, reporting |
| Folklore | Protected; commercial use requires permission |
| Enforcement | Commercial court division of the High Court |
| Register | Maintained by the Registration Services Bureau |
| Commercial Court | Hears infringement claims |
In practice
- Register the work: without a certificate, proving authorship becomes the whole case.
Where to go
- Uganda Registration Services Bureau.
- Uganda Performing Right Society.
- Commercial Court, High Court of Uganda.
Worth knowing
Registration is voluntary but the certificate is the practical starting point for any enforcement action: without it, proving authorship becomes the whole case. Registration is voluntary but is the practical starting point for enforcement. Unregistered works face an uphill evidential battle.
Frequently asked questions
Is there a fair use exception in Uganda?
The Act contains fair-use style provisions permitting use for private study, research, criticism, review and news reporting, subject to fairness and acknowledgment. It is broader than a closed list of specific exceptions but narrower than the American doctrine; each use is judged on its facts.
The general article: Copyright · Compare with another country
Identity theft
Computer Misuse Act offences and penal code impersonation, with mobile money fraud the dominant pattern.
The Computer Misuse Act 2011, as amended, and penal code provisions on personation and obtaining by false pretences cover identity fraud. The national identity card is required for SIM registration and mobile money, so the loss of a card can quickly become the loss of an account. The Uganda Police cyber crime unit handles reports.
Key points
| Statutes | Computer Misuse Act 2011 as amended, and penal code personation offences |
|---|---|
| National ID | Required for SIM registration; report loss to NIRA and the police |
| Mobile money | Report to the operator immediately; keep the transaction references |
| Data protection | Data Protection and Privacy Act 2019 for the underlying breach |
| Enforcement | Uganda Police Force Cyber Crime Unit |
| Banking | Bank of Uganda for unresolved complaints against a bank |
In practice
- Call the mobile money operator's fraud line as soon as you notice a transaction you did not make.
- Report the loss of a national ID to NIRA and to the police, and keep both references.
- Open a police case and request the cyber crime unit.
- Change PINs on every financial service and never share a one-time code.
Where to go
- Uganda Police Force Cyber Crime Unit.
- NIRA for national identity cards.
- Bank of Uganda complaints desk.
Worth knowing
No legitimate agent or operator ever asks for your mobile money PIN or for a one-time code: any such request is fraud, whatever caller ID it shows.
The general article: Identity theft · Compare with another country
Online shopping
Consumer rules sit in the Uganda Communications Act and sale of goods legislation, and mobile money complaints go to the operator first.
Protection comes from consumer provisions in the Uganda Communications Act and sale of goods legislation, with a competition and consumer protection framework enacted in recent years. Mobile money complaints go to the operator and then to the Communications Commission or Bank of Uganda.
Key points
| No comprehensive statute | A consumer protection bill has been pending for years |
|---|---|
| Sale of Goods and Supply of Services Act 2017 | Provides implied terms and remedies |
| Sector regulators | Communications and financial regulators handle complaints in their areas |
| Small claims procedure | Available in magistrates' courts for low-value disputes |
In practice
- Use the small claims procedure at the magistrate's court for modest amounts.
- For telecom and financial services, complain to the sector regulator first.
Where to go
- Uganda Communications Commission.
- Bank of Uganda financial consumer protection.
- Uganda National Bureau of Standards.
Worth knowing
The 2017 Act modernised sale of goods law and gives implied terms about quality. It is the main source of consumer rights in the absence of a general statute.
The general article: Online shopping · Compare with another country
Romance scams
A police cybercrime unit, and mobile money blocking as the only fast route.
Reports go to the police cybercrime unit and to the communications regulator. As elsewhere in the region, mobile money dominates and the operator's block is the only mechanism that works quickly enough to matter.
Where to go
- Mobile money operator, immediately
- Communications regulator
Sources
- Uganda Police Force — Cybercrime Unit, CID headquarters, Kibuli — report in person or at any station
- Uganda Communications Commission — 0800 222 777 — toll-free line and online complaint; a reported fraudster's SIM is blocked while the case is investigated
- Your mobile money provider's fraud line — the fastest lever: call before the funds are withdrawn
- eConsumer.gov — international channel for scams committed from abroad
The general article: Romance scams · Compare with another country