Uganda’s Personal Data Protection Office (PDPO) has ruled that Google LLC violated Uganda’s Data Protection and Privacy Act by collecting and processing Ugandan citizens’ data without registering locally. The PDPO ordered Google to register with Uganda’s regulator within 30 days and provide evidence on how it complies with local data transfer requirements. This decision expands accountability for global tech firms operating in Uganda, stressing that even companies without a physical presence must comply with Ugandan law when handling personal data of Ugandans. However, enforcement of such rulings remains limited, as Uganda’s PDPO does not have authority to issue fines or binding corrective orders to non-compliant entities, highlighting the need to strengthen the regulator’s powers for effective enforcement.
