The legal framework
Article 27 of the Constitution protects privacy of person, home, correspondence and communication. The Data Protection and Privacy Act 2019 applies to government as well as private entities and is administered by the Personal Data Protection Office, established within the national IT authority.
Uganda's Constitution protects privacy of the person, home, correspondence and communication, and the Data Protection and Privacy Act of 2019 created rights of access and correction and a regulator within the national information technology authority. Alongside it, the Computer Misuse Act has been used against online publication, and amendments in 2022 drew criticism for provisions on unsolicited and malicious information.
Key points
| Constitution | Article 27 |
|---|---|
| Statute | Data Protection and Privacy Act 2019, applying to public and private bodies |
| Regulator | Personal Data Protection Office |
| Registration | Data collectors, controllers and processors must register |
| Offences | Unlawful obtaining or disclosure of personal data is criminal |
| Remedy | Complaint to the Office, and Article 50 enforcement in court |
| Applies to government | Public bodies are covered by the 2019 Act |
| Compensation | The Human Rights Commission can award it directly |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- Where a state agency is involved, the Human Rights Commission can award compensation without a court case.
Where to go
- Personal Data Protection Office.
- Uganda Human Rights Commission, which can award compensation.
- Legal Aid Service Providers Network.
Worth knowing
The Uganda Human Rights Commission can itself order compensation, which is unusual: for intrusions by state agencies it is often more effective than the courts. The Commission's power to award compensation is unusual and makes it the most effective route against state intrusion.
Frequently asked questions
What does the Data Protection and Privacy Act cover?
Lawful collection and processing of personal data, consent, rights of access and correction, security obligations and registration of data collectors with the regulator. It applies to public and private bodies and to processing of Ugandans' data outside the country.
What can you do if a former partner shares private material?
Save the evidence first — screenshots with the address, the date and the account name — then report it to the platform, which is the fastest route to removal. Send a written demand to stop and to delete. Where the material is intimate, check whether a specific criminal offence applies, and whether a protection order is available: in several jurisdictions a court can prohibit further publication within days, which is quicker than any damages claim.
Official sources and links
- UN Human Rights Office — ratified treaties and country reviews
- ILO NATLEX — national legislation database