Section 29(1) of the Act and Regulation 15(1) require every data controller, data collector or data processor to register with the Personal Data Protection Office (“PDPO”). This requirement applies not only to entities established in Uganda, but also to entities located outside Uganda that collect personal data relating to Ugandan citizens. Registration must be renewed annually. 

Registered entities are further required to submit an annual compliance report to the PDPO by the 30^th of September and within ninety (90) days after the end of each financial year.

Due to increased enforcement activity by the PDPO, including investigations, and regulatory action arising from complaints lodged by data subjects against entities that have not complied with the registration requirements, it is important to ensure that all registration and reporting obligations are up to date.

Should you require assistance with registration, renewal or annual compliance report filings, or have any queries regarding your obligations under Uganda’s data protection framework, please contact your relationship partner at AF Mpanga Advocates.