Règlement sur les frais de l'autorité de régulation des communications


THE REPUBLIC OF UGANDA

# THE DATA PROTECTION AND PRIVACY REGULATIONS, 2021.

# STATUTORY INSTRUMENTS SUPPLEMENT

to The Uganda Gazette No. 23, Volume CXIV, dated 12th March, 2021

Printed by UPPC, Entebbe, by Order of the Government.

# STATUTORYINSTRUMENTS

# 2021 No .21.

# THE DATA PROTECTION AND PRIVACY REGULATIONS, 2021

# Regulation

# Part IPreliminary

1. Title
2. Interpretation

# Part II—Personal Data Protection Office

1. Establishment of Personal Data Protection Office
2. Additional functions of Personal Data Protection Office
3. Powers of Office
4. Office to cooperate with other authorities

# Management of Personal Data Protection Office

1. National Personal Data Protection Director
2. Functions of National Personal Data Protection Director

. Other officers and staff of Office

# Part III—Data Collection and Processing

1. Objection to collection and processing of data
2. Personal data relating to children

Data protection impact assessment

# Part IV—Data Protection Register

.Data Protection Register 14Information contained in Register

Part V—Registration of Data Collectors, Data Processors and Data Controllers

15Data collectors, data processors and data controllers to register with Office 16. Application for registration

Procedure for considering application

7Procedure for considering application. 18Report in respect of application

Grant or refusal of registration

Grant of registration and issue of certificate 20Validity of registration 21.Refusal of registration 2.Review of decision 23. Renewal of registration 24Cancellation of registration 25. Removal from Register 26Effect of ceasing to collect and process data Duty to notify changes of information in Register 28. Search and inspection of Register

Part VI—Data Correction and Processing

29.Request to correct or delete personal data 1. 30.Processing personal data outside Uganda

# Part ViI—Security of Data

1. Publication of personal data security practices and procedures
2. Security measures by data controller
3. Notification of data security breaches

# Part ViiiRights of Data Subjects

1. Processing or collection information without consent
2. Right to access personal information
3. Right to prevent processing of personal data

37.Right to appeal decision to continue processing personal data 38. Rights in relation to automated decision making 39Rectification, blocking, erasure and destruction of personal data

# Part IX—Complaints and Investigations

1. Complaints handling by data collectors, data controllers and data processors
2. Complaints against breach and noncompliance
3. Office to investigate complaints
4. Preservation of information during investigation

4Director may seek assistance in investigation 45. Decision on complaint 46. Appeals

# Part X-General

1. Designation of data protection officer
2. Failure to comply with notice
3. Authority to monitor compliance.

50Reports by data collector, data processor, data controller

# SCHEDULES

# SCHEDULE 1—FORMS

For —oiceoOecon o Colectin/Procesin oPronl Form 2 — Application for Registration/Renewal of Registration Form 3 — Undertaking Not to Process or Store Personal Data Outside Uganda Form 4 — Certificate of Registration Fo5—iction o Certd o ExatEntry iR Form 6 - Complaint Concerning Processing Personal Data Without Appropriate Security Measures Form 7 — Notification of Data Breach Form 8 — Request to Confirm Possession of Personal Data