The first phase of Uganda's data protection regime was administrative: register, appoint, and file. The second phase asks a harder question: whether an organisation can demonstrate, on demand, the lawful basis on which it holds and processes what it holds.
Most institutions can answer the first question. Considerably fewer can answer the second with documents rather than assurances.
Two decisions in July 2025 mark the turn. Neither concerned a sophisticated cyber attack. Both turned on records that should already have existed.
The first was criminal. On 10 July 2025 the Standards, Utilities and Wildlife Court recorded the first conviction under the Data Protection and Privacy Act, 2019. The accused was the director of a digital lender who had circulated a borrower's photograph, name and contact details on WhatsApp, threatening public exposure if the loan was not repaid. The borrower complained to the Personal Data Protection Office. The director was charged with operating without registration and with processing personal data without consent. The court convicted on the registration count and imposed a fine. The consent count was resolved by court-sanctioned reconciliation, with compensation paid to the borrower.
The second was regulatory. On 18 July 2025 the Personal Data Protection Office decided a complaint brought by four Ugandan citizens against Google LLC. It found that Google had not registered under section 29 of the Act and regulation 15 of the Data Protection and Privacy Regulations, 2021, and that it had not shown a lawful basis for moving Ugandans' personal data outside the country under section 19 and regulation 30. Google was ordered, within thirty days, to register, to give the contact details of its data protection officer, and to produce evidence of the framework under which it transfers data abroad.
The office rejected the argument that the Act reaches only entities domiciled in Uganda. Section 1 applies the Act to a person or institution outside Uganda that collects, processes, holds or uses personal data relating to Ugandan citizens, and the office treated Google's tax registration in Uganda as further evidence of a commercial presence. It did not order data localisation. It declined to award compensation, holding that it has no power to do so; a data subject who wants damages must go to court.
Read together, the two decisions settle three points. Registration is not a formality that can wait for a gazetted exemption. Offshore processing of Ugandans' data is within reach of the regulator. And the failures in both cases were the easiest kind to prove: no registration, no documented transfer basis, no one answering complaints. The Google complainants' email to the company's compliance function had gone unanswered before they went to the office.
For a bank, lender, insurer, telecoms operator, hospital or platform, the practical test is what could be handed to the office within a week of a complaint. We would expect that to include five things.
First, a current certificate of registration with the Personal Data Protection Office, renewed each year, for every entity in the group that collects or processes personal data in Uganda or about Ugandans. Registration attaches to the entity, so a parent's certificate should not be assumed to cover its subsidiaries.
Second, a record of processing: what personal data is held, for what purpose, on what lawful basis, by whom, and for how long. Where consent is the basis, the record of how and when it was given.
Third, for every flow of personal data out of Uganda, including to a group data centre, a cloud provider or an outsourced service centre, the legal basis for the transfer and the safeguards that protect the data at the other end. The office does not require approval for each transfer, but it does expect the reasoning to be written down and available for inspection.
Fourth, a named data protection officer and a channel through which data subjects' requests and complaints are logged and answered. Both of the July 2025 cases began with a complaint from an individual.
Fifth, a breach procedure. Section 23 requires the office to be notified immediately where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person, together with the remedial action taken. The office then decides whether, and how, the affected individuals must be told. An organisation that has to work out who makes that call during an incident has already lost time it does not have.
Two groups face particular exposure. Digital lenders and debt collectors: the July conviction shows that collection practices built on contact lists and public shaming are a criminal matter, not only a consumer protection one. And international groups serving Ugandan customers from abroad: the Google decision confirms that hosting data outside the country does not take it outside the Act.
The consequences of ignoring an order are also clearer. The Google decision records that failing to comply with an order of the office is itself an offence under the Regulations, and that an aggrieved party's appeal lies to the Minister responsible for ICT within thirty days.
None of this requires a new compliance programme. It requires the existing one to produce evidence. The organisations that will find the enforcement phase uncomfortable are those whose compliance exists in policies rather than in records.