The duty to register
The Data Protection and Privacy Act, Cap. 97 establishes the Personal Data Protection Office under section 4 and requires it, under section 29, to maintain a register of every person, institution and public body that collects or processes personal data. Registration is made to the Office in the prescribed manner, and the Data Protection and Privacy Regulations, 2021 set out the particulars to be supplied and the fee. Registration is usually the first step a business takes under the Act, and in many businesses it is the only one.
A certificate of registration confirms that the Office has been told what personal data the business holds and for what purpose. It does not show that the business can demonstrate, when a complaint under section 31 or an investigation under section 32 arrives, how that data is collected, stored, shared and deleted. The Office's practice on complaints is to ask for the documents that lie behind the registration, and a business that registered without preparing them is answering the complaint and writing its policies at the same time.
The documents behind the registration
The Act and the Regulations expect a set of documents to sit behind the registration. The first is a privacy notice that describes what the business actually does with personal data: the categories collected, the purposes, the legal basis, the recipients, the retention period and the rights of the data subject. The second is a data protection policy that governs the staff who handle the data, with the procedures for access requests, breaches and the appointment of the data protection officer that section 6 requires of institutions within its scope. The third is a retention schedule, since the Act requires that personal data be kept no longer than the purpose requires. The fourth is an information security policy, with the technical and organisational measures the Act requires the controller to adopt.
Where processing is likely to carry a high risk to data subjects, the Regulations require a data protection impact assessment before the processing begins, and the Office asks for it in any investigation that concerns profiling, biometrics, health data or the data of children. Where personal data is processed or stored outside Uganda, section 19 requires the controller to ensure either that the destination country has protection at least equivalent to the Act or that the data subject has consented, and a transfer agreement with the recipient is the document that evidences the first of those conditions.
One framework for several regulators
The firm drafts these documents to the standard of the EU General Data Protection Regulation, which is higher than the minimum the Ugandan Act requires. The reason is practical. A client operating in several African markets answers to several regulators, in Kenya under the Data Protection Act, 2019, in Rwanda under Law No. 058/2021 and in Nigeria under the Nigeria Data Protection Act, 2023, each of which draws on the same European model. A framework written to the higher standard can be adopted in each of those markets with a local schedule that records the registration, the supervisory authority and the national variations, instead of a separate policy suite for every country, and the group's compliance function administers one set of documents.
Complaints and investigations
In a complaint or an investigation the Office asks for the register of processing activities, the privacy notices, the impact assessments and the record of the breach or the request that gave rise to the complaint. A business that can produce them on the day the letter arrives is in a different position from one that starts writing them in response, and the Office's determinations reflect that difference. The firm registers controllers and processors, prepares the policy suite, conducts impact assessments, drafts the transfer agreements that section 19 requires, and acts for controllers and data subjects in complaints and investigations before the Office.