UGANDA’S DATA PRIVACY LAWS: SAFEGUARDS AND FLAWS IN THE DIGITAL AGE.

Joshua Morris Byaruhanga
6 hours ago
2 min read

In our next segment analysing UGANDA’S DATA PRIVACY LAWS: SAFEGUARDS AND FLAWS IN THE DIGITAL AGE, Lawpoint Uganda, together with DPO Privacy Centre East Africa, features insights from Byaruhanga Joshua Morris on the evolving challenges and future of data protection in Uganda.

Morris notes that the right to data portability is a fundamental data protection principle that empowers individuals to exercise greater control over their personal information by enabling them to transfer data between service providers. While this right is expressly recognised under Kenya’s legal framework, it remains absent from Uganda’s current data protection regime.

Globally, 13% of organisations reported breaches involving AI models or applications between 2024 and 2025. In Uganda, 59% of MDAs reported experiencing cyber incidents within the previous year, highlighting the urgent need for Uganda’s data protection laws to address emerging technologies such as Artificial Intelligence.

Morris proposes the following recommendations and way forward;

Secure the institutional independence of the Personal Data Protection Office from NITA-U.
Amend the law to grant the Personal Data Protection Office quasi-judicial powers, including the authority to issue administrative fines.
Bridge the knowledge gap through digital literacy partnerships with civil society organisations.
Enforce stringent measures against non-compliant entities, including Big Tech companies.
Proactively amend the Act by 2027 to incorporate emerging technologies and the right to data portability.
Encourage continuous dialogue between the government and the private sector on data governance and digital rights.

Uganda’s journey toward robust data protection remains ongoing. While the Data Protection and Privacy Act established an important “digital shield,” recent convictions demonstrate that the framework still lacks the strong enforcement mechanisms necessary to effectively deter violations. Uganda can draw valuable lessons from regional models, particularly Kenya’s, to bridge existing legislative and institutional gaps.

“Data privacy is not merely a technical concern; it is fundamentally a human rights issue. It is about protecting our autonomy, dignity, and freedom in the digital realm.”

Read the full document