UgandaData Protection and Privacy Act, 2019, enforcement and offences
Data Protection and Privacy Act, 2019, ss. 31-38 (enforcement and offences)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 3 May 2019.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect a data subject or any other person to be able to complain to the National Information Technology Authority that you are infringing their rights or violating this Act, and expect the Authority to investigate every complaint and be able to direct you to remedy a breach.
- Expect a data subject who suffers damage or distress from your contravention of this Act to be able to sue you in court for compensation, and be ready to prove you took reasonable care to comply in order to defend the claim.
- Do not unlawfully obtain, disclose, destroy, delete, mislead, conceal, alter, sell or offer to sell personal data, on pain of a fine of two hundred and forty to two hundred and forty five currency points or imprisonment of up to ten years, or both.
- Expect a convicted corporation to face an additional fine of up to two percent of its annual gross turnover, and expect an officer who knowingly and wilfully authorised or permitted the offence to be liable alongside it.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Unlawfully obtaining or disclosing personal data, unlawfully destroying, deleting or altering personal data, or selling personal data is an offence punishable by a fine of 240 to 245 currency points (UGX 4,800,000 to UGX 4,900,000) or imprisonment of up to ten years, or both (ss. 35-37); a convicted corporation may additionally be fined up to two percent of its annual gross turnover (s. 38(2)).
Penalty structure
The highest individual fixed cap among the Act's offences (sale of personal data, s. 37(2), 245 currency points); unlawful obtaining or disclosure and unlawful destruction or alteration (ss. 35-36) each carry 240 currency points (UGX 4,800,000). Each offence also carries imprisonment of up to ten years as an alternative or addition. A convicted corporation may additionally be fined up to two percent of its annual gross turnover (s. 38(2)).
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- UGX
- Fixed cap
- 4,900,000
Who enforces it
Enforcement body
National Information Technology Authority - Uganda (Personal Data Protection Office)
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Section 31 lets a data subject or any other person complain to the Authority in the prescribed manner that a data collector, processor or controller is infringing their rights or violating the Act, and lets a data collector, processor or controller itself complain to the Authority in writing about a violation or non-compliance.
Section 32 requires the Authority to investigate every complaint and lets it direct a data collector, processor or controller to remedy a breach or take other action to restore the integrity of the data or the data subject's rights.
Section 33 gives a data subject who suffers damage or distress through a contravention of the Act a right to apply to a court of competent jurisdiction for compensation from the data collector, processor or controller responsible, a private right of action, subject to the defence that the person took reasonable care to comply. Section 34 lets a person aggrieved by an Authority decision appeal to the Minister within thirty days, with a copy of the appeal going to the Authority.
Sections 35 to 37 make it an offence to unlawfully obtain, disclose or procure the disclosure of personal data, to unlawfully destroy, delete, mislead, conceal or alter it, or to sell or offer to sell it, each punishable on conviction by a fine of two hundred and forty to two hundred and forty five currency points (twenty thousand Uganda shillings per currency point) or imprisonment of up to ten years, or both.
Section 38 extends those offences to a corporation and to any officer who knowingly and wilfully authorises or permits the contravention, and lets a court additionally fine a convicted corporation up to two percent of its annual gross turnover, having regard to the gravity and impact of the offence.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisionsis_listed_company
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://ulii.org/en/akn/ug/act/2019/9/eng@2019-05-03Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.