Uganda Data Protection Act 2019 and AI: a PDPO compliance guide
NIN, mobile money, ChatGPT: what Uganda's Data Protection and Privacy Act 2019 and the PDPO expect from companies whose teams use generative AI at work.
In Kampala, generative AI is already part of office life. A bank analyst asks ChatGPT to summarise a loan file, a telecom customer service agent has a complaint reply rewritten, an HR manager compares applications with Copilot. The time saved is real.
The problem is what travels with the request. A national identification number, a phone number linked to a mobile money account, a payslip. In Uganda, this information is protected by a specific law, the Data Protection and Privacy Act 2019, and by a regulator that expects organisations to be registered and able to account for what they do with personal data.
A legal framework in place since 2019
The Data Protection and Privacy Act came into force on 3 May 2019. It builds on Article 27 of the Ugandan Constitution, which already protects privacy. Its implementing rules, the Data Protection and Privacy Regulations, have applied since 12 March 2021.
The Act covers any person or organisation that collects, processes, holds or uses personal data in Uganda. It also reaches organisations based abroad that process the data of Ugandan citizens.
The PDPO and the registration requirement
The regulator is the Personal Data Protection Office, or PDPO. It was created by the Act and sits within the National Information Technology Authority, NITA-U. It keeps the national data protection register, handles complaints and can order corrective measures.
What often surprises foreign companies is the registration requirement. The 2021 Regulations require every data collector, controller and processor to register with the PDPO. This also applies to organisations outside Uganda that process the data of Ugandan citizens. Any company using AI on customer data should first check that it actually appears on the register.
NIN and mobile money: data at the heart of daily life
In Uganda, two types of data flow through almost every information system.
The NIN, the national identification number issued by NIRA. It is needed to open a bank account, register a SIM card or access many public services.
Mobile money identifiers, often just a phone number, tied to a transaction history. MTN MoMo and Airtel Money are part of daily life for millions of Ugandans.
Financial and health data, which the Act treats as special personal data, together with religious or philosophical beliefs, political opinions and sexual life.
A mobile money transaction export pasted into an AI assistant to "understand an anomaly" almost always contains several of these elements. This is exactly the kind of silent leak we describe in the anatomy of an AI data leak.
What the law requires when your teams use AI
Controlled transfers
Most consumer AI assistants process data outside Uganda. The Act only allows processing or storage abroad if the destination country offers adequate protection, or if the data subject has consented. The Regulations also forbid onward transfer to a third country without consent. A prompt containing customer data can therefore become an unlawful transfer.
Breach notification
When an unauthorised person may have accessed personal data, the organisation must inform the PDPO immediately. The regulator then decides whether the people affected must be told. Registered entities also submit an annual report on their incidents.
Penalties that also reach management
A court can fine a company up to 2% of its annual gross turnover. Some offences carry prison sentences of up to ten years.
AI, the next step in Uganda's digital policy
The Ministry of ICT and National Guidance is preparing a national strategy for emerging technologies, including AI. Announced for mid-2026, it is due to include an ethics and governance chapter aligned with the 2019 Act.
Companies therefore do not need to wait for an AI-specific law. The rules that apply to their prompts already exist. The cost of uncontrolled adoption is set out in the real cost of shadow AI in 2026.
A five-step action plan
Check your registration with the PDPO, including for group entities located outside Uganda.
Map AI use by department: banking, customer service, HR, finance.
List the data banned from prompts: NINs, mobile money numbers, health data, salaries.
Anonymise at the source rather than block. Our article on format preserving anonymization explains how to keep answers useful.
Keep evidence of prevented incidents for your annual report and your dealings with the regulator.
How ZeusLock helps companies in Uganda
ZeusLock runs directly on your employees' devices and browsers. Before a prompt or file reaches ChatGPT, Copilot, Gemini or Claude, it detects sensitive data, including NINs, Ugandan phone numbers and payment identifiers. Depending on your rules, it anonymises them while keeping their format, warns the user or blocks the upload. Every event is logged to build compliance evidence.
Summary
Uganda has a complete data protection law, an active regulator and a registration requirement that many underestimate. Generative AI does not change these rules, it multiplies the chances of breaking them. Companies that protect their prompts today will be able to adopt AI with confidence.
Want to see how to protect your Ugandan customers' data? Book a ZeusLock demo.
Protect your data from AI leaks
See ZeusLock stop sensitive data before it reaches ChatGPT, Claude, Gemini and more, in a 30-minute demo.
