Personal Data Protection Office (PDPO) Registration
Businesses that collect or process personal data must register with the Personal Data Protection Office (an independent office under NITA-U) and renew annually. Registration promotes transparency and is required under the Data Protection and Privacy Act.
Who needs it
Every data collector, data processor and data controller — including individuals, organisations and public bodies — that collects or processes personal data, under Section 29 of the Data Protection and Privacy Act, 2019 and Regulation 15(1) of the Data Protection and Privacy Regulations, 2021. No exemptions have yet been gazetted, so the requirement currently applies broadly. Entities outside Uganda processing data of Ugandan citizens are also covered.
Fees
UGX 100,000
The registration fee is UGX 100,000 (approximately USD 30), paid via a URA-generated PRN at a bank or by mobile money. Renewal is also UGX 100,000 and registration is renewed annually. Failure to register is an offence: Uganda's first PDPO conviction resulted in a fine of UGX 300,000 for failure to register.
Documents required
- Applicant information (name, address, contacts, nature of business)
- Data Protection Officer details (name, official address, contacts)
- Description of data processing activities
- Written undertaking not to process/store personal data in countries without adequate protection
- Proof of payment of the registration fee
Steps to apply
- 1Generate a PRN on the URA portal and pay the UGX 100,000 fee
- 2Complete the registration application form on the PDPO website
- 3Provide applicant and Data Protection Officer details and the undertaking
- 4Submit the application to the PDPO
- 5Receive registration (valid one year); renew at least three months before expiry and file an annual compliance report
Key facts
- Validity / renewal
- Annual (1 year), renewable
- Legal basis
- Data Protection and Privacy Act, No. 9 of 2019; Data Protection and Privacy Regulations, 2021