Uganda DPPA
Market regime · Data Protection and Privacy Act, 2019 (Uganda)
Republic of Uganda
Uganda
2019; regulations 2021, PDPO operational
Personal Data Protection Office (PDPO)
You process personal data of data subjects in Uganda
Curated, versioned & cross-mapped
The obligation, plainly.
Uganda's Act established the Personal Data Protection Office and the now-familiar regional shape: registration of controllers and processors, lawful-processing principles, data-subject rights and security obligations.
Its sharpest edge is the breach duty: notification to the PDPO is required immediately, language stricter on its face than any fixed clock in the portfolio, which makes a rehearsed, evidenced incident workflow the only defensible posture.
Where programmes are tested.
PDPO registration
Controllers and processors registered and renewed with the office.
Immediate breach notification
Breaches notified to the PDPO immediately, with the response evidenced.
Principles and rights
The Act's principles and rights operationalised, not just documented.
Curated once, evidenced continuously.
- Curated with its immediate-notification duty explicit and cross-mapped to the shared privacy and incident controls, one East African programme, regulator-specific clocks.
- Requirements resolve to shared controls: implement a control once and it counts toward every framework it maps to.
- Status is evidence-gated: a requirement can't be marked implemented without valid, in-date evidence behind it.
- Every attestation carries maker/checker, and every action lands in an append-only audit trail.
Uganda DPPA, asked plainly.
The questions compliance teams actually ask before an adoption decision or an audit.
What does 'immediate' breach notification mean in practice?
The Act's language sets no grace window, so the defensible reading is: notify as soon as the facts support a report, and evidence why the timeline you took was as fast as reasonably possible. Workflow and rehearsal matter more here than anywhere with a fixed clock.
Who must register with the PDPO?
Controllers and processors under the Act and its 2021 regulations, with the office maintaining a public register. As across East Africa, the certificate is becoming a standard due-diligence artefact.
How does Uganda's act fit the regional pattern?
It shares the principles-rights-registration architecture of Kenya's and Tanzania's acts, with the immediacy of its breach duty as the local sharp edge. The catalog cross-maps all three to one control set and keeps each regulator's specifics explicit.
Where it connects.
The full catalogCompliance you can prove.
Walk into your next audit ready.
Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.
The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.