THE REPUBLIC OF UGANDA
# THE DATA PROTECTION AND PRIVACY ACT, 2019
Act No. 9 of 2019
# ACTS SUPPLEMENT
to The Uganda Gazette No. 21, Volume CXII, dated 3rd March, 2019.
Pied yEnebede th Govermn
# Act 9
Data Protection and Privacy Act
2019
THE DATA PROTECTION AND PRIVACY ACT, 2019.
ARRANGEMENT OF SECTIONS
# Section
# Part I—Preliminary
- Application.
- Interpretation.
Part II—PrincIples of Data Protection
3Principles of data protection.
Part III—Data Collection and Processing
4Establishment of the personal data protection office 5Functions of the personal data protection office 6.Data protection officer 7Consent to collect or process personal data 8.Personal data relating to children 9.Prohibition on collection and processing of special personal data 0.Protection of privacy 11. Collection of data from data subject. 12.Collection of personal data for specific purpose 13.Information to be given to data subject before collection of data 14. Minimality 15.Quality of information 16. Correction of personal data 17.Further processing to be compatible with purpose of collection 18. Retention of records of personal data Processing personal data outside Uganda
Part IV—Security of Data
- Security measures
1Security measures relating to data processed by data processor
# Section
Data processed by operator or authorised person Notification of data security breaches
# Part V—Rights of Data Subjects
2Right to access personal information Right to prevent processing of personal data Right to prevent processing of personal data for direct marketing Rights in relation to automated decision-taking Rectification, blocking, erasure and destruction of personal data
# Part VI—Data Protection REgister
- Data protection register
- Access to register by the public
# Part VII—COmplaInts
Complaints against breach and non-compliance 3Authority to investigate complaints 33.Compensation for failure to comply with this Act 34. Appeals
# Part VIII—OfFences
Unlawful obtaining or disclosing of personal data. 36. Unlawful destruction, deletion, concealment or alteration of personal data. 3.Sale of personal data 3Offences by corporations. 39. Regulations 40. Power of the Minister to amend Schedule
# THE DATA PROTECTION AND PRIVACY ACT, 2019
An Act to protect the privacy of the individual and of personal data by regulating the collection and processing of personal information; to provide for the rights of the persons whose data is collected and the obligations of data collectors, data processers and data controllers; to regulate the use or disclosure of personal information; and for related matters.
Date OF AssEnt: 25th February, 2019.
Date of Commencement: 3rd May, 2019
BE IT ENActED by Parliament as follows:
# Part I—PrEliminary
# 1. Application.
This Act applies to a person, institution or public body—
(a) collecting, processing, holding or using personal data within Uganda; (b) outside Uganda who collects, processes, holds, or uses personal data relating to Ugandan citizens.
# 2. Interpretation.
In this Act unless the context otherwise requires—
Authority" means the National Information Technology Authority - Uganda;