The Personal Data Protection Office (PDPO) of Uganda has issued a decision reaffirming that data controllers are liable for the proper handling of personal data. In a recent complaint (PDPO 061/2024) involving Chipper Technologies Uganda Limited, the PDPO assessed multiple issues including data retention, breach notification, subcontractor alerts, and access rights. While no infringement occurred in this case, the PDPO directed the respondent to update their Privacy Notice, clearly requiring explicit consent for data processing beyond regulatory compliance. The office highlighted that failure to follow these directions could result in legal penalties, fines, or imprisonment, ensuring strong accountability for data controllers under Uganda’s Data Protection and Privacy Act, Cap. 97.

Source:
Complaint PDPO 061/2024, Personal Data Protection Office Uganda, Decision dated March 12, 2025