Generally, a person’s right to informational privacy is protected under Article 27 of the Constitution of the Republic of Uganda. The protection under the Constitution is supplemented by the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021, which regulate the collection, processing, use, storage, and disclosure of personal data. The Act and Regulations apply to any person, entity or public body:

• collecting, processing, holding or using personal data within Uganda;
• outside Uganda who is collecting, processing, holding or using personal data of Ugandan citizens.

The Data Protection and Privacy Act commenced on 3 May 2019 while the Regulations took effect on 12 March 2021.

There are also other sector specific laws that incorporate data protection provisions applicable to the activities governed under those laws. These laws include, but are not limited to:

• The Access to Information Act, 2005;
• The Regulation of Interception of Communications Act, 2010 and Regulations, 2023;
• The Computer Misuse Act, 2011 (as amended); and
• The Registration of Persons Act, 2015.