Section 19 of the Data Protection and Privacy Act permits for personal data to be processed or stored outside Uganda provided that:

• the country in which the data is processed or stored has adequate measures in place for the protection of personal data which are  at least equivalent to the protection provided under the Act; or
• the data subject has consented.

Regulation 30(2) of the Data Protection and Privacy Regulations prohibits any further transfer of personal data processed outside Uganda to a third country without the consent of the data subject.

Under Regulation 30(4), the Personal Data Protection Office is required to specify the countries with adequate or equivalent protection for purposes of data transfer. This publication is yet to be released by the Office.