The Data Protection Act, which was enacted on 3rd May 2019, applies to data controllers and processors established or resident in or outside Uganda in so far as they process personal data while in Uganda or of data subjects located in Uganda. This law was enacted in accordance with the requirements of Article 27 of the Constitution of Uganda. Therefore, data protection and privacy have a constitutional underpinning.
At CM Advocates Uganda, our practice in cybersecurity, privacy and data protection focuses on internet sectors, e-Commerce and intellectual property, regulated industries (like telecom, financial, pharmaceutical, advertisement and gaming sectors) as well as public entities. We have expertise on contentious matters like data protection law-related claims of the individuals affected (such as employees’ information claims) and data breaches as well as non-contentious matters including data protection contracts, cybersecurity and data management advisory, data protection audits and compliance projects. In addition to assisting clients in their response to regulator investigations, we advise on class action lawsuits and other claims that arise out of privacy violations and security breaches. In collaboration with our other teams, we also counsel clients on crosscutting issues including on labour and employment, consumer protection, competition law and product-based liability.
We can advise our clients at each stage of the data lifecycle. At the first stage, we help our clients assess and reduce their privacy and security risks and comply with applicable laws. When developing new products and services or during marketing stage, we assist clients by advising on privacy and security at the outset to maximize the effectiveness of their offerings and avoid legal and regulatory pitfalls. We advise clients on complex issues associated with both personal and sensitive business data, including its collection, use, storage, disclosure, transfer and destruction. We guide and advise clients on legal compliance and business strategy relating to privacy and security risk.