Uganda Data Protection Act: IT Checklist for Businesses

If your business collects names, phone numbers, staff records, customer details, CCTV footage or fingerprints, you are handling personal data. In Uganda, that brings you under the Data Protection and Privacy Act, 2019, and the regulations made under it.

Most conversations about the Act focus on legal paperwork. But much of what the law expects lives in your IT: who can access data, how it is protected, where it is stored, and what happens if it leaks. This guide translates those expectations into practical technical steps.

This article is general information from an IT infrastructure provider. It is not legal advice. Check your specific obligations with a qualified lawyer or the Personal Data Protection Office.

The short version

The Act is built around a few ideas that affect your systems:

• Collect personal data only for a clear, lawful purpose, and only what you need.
• Be open with people about what you collect and why, and get consent where required.
• Keep the data accurate and do not hold it longer than necessary.
• Protect it with appropriate security measures.
• Respect people's rights to see, correct or ask about their data.
• Act promptly and report if there is a breach.
• Organisations that collect or process personal data are expected to register with the Personal Data Protection Office.

Each of these maps to something your IT team or provider can build, configure or document.

Where personal data hides in a typical business

Before you can protect personal data, you need to know where it is. Most businesses are surprised by the list:

• HR and payroll files, including national ID numbers and bank details
• Customer databases, POS records and loyalty data
• Email accounts and shared drives
• Hotel guest registration and booking systems
• School or clinic records
• CCTV recordings showing identifiable people
• Biometric attendance and access control templates (fingerprint or face data)
• Visitor logs at reception
• Backups, which contain copies of all of the above
• Staff laptops and phones

Start with a simple data map: what personal data you hold, where it sits, who can access it, and how long you keep it.

Turning legal expectations into technical controls

CCTV and the Act

CCTV footage of identifiable people is personal data. If you run cameras, consider:

• Purpose: be clear why you have cameras (security, safety) and do not use footage for unrelated purposes.
• Notice: display clear signs where cameras operate.
• Placement: avoid areas where people expect privacy, such as changing rooms and toilets.
• Access: limit who can view or export footage, and log who does.
• Retention: set a defined retention period and let old footage overwrite or delete automatically.
• Security: protect NVRs and VMS with strong passwords, updated firmware, and network segmentation. Exposed or default-password cameras are a common weakness.
• Remote viewing: secure remote access with MFA or VPN rather than opening cameras directly to the internet.

Our guides on CCTV security systems cover the technical side.

Biometric systems and the Act

Fingerprint and face data can identify a person for life, which makes it especially sensitive. If you use biometric attendance or access control:

• Be clear with staff and visitors about what is collected and why, and keep a record of consent or the lawful basis you rely on.
• Collect only what the system needs.
• Keep biometric readers and controllers on a separate network segment (VLAN) from general traffic. See our guide on VLANs for biometric readers.
• Encrypt stored templates and restrict who can administer the system.
• Delete data for people who leave, in line with your retention policy.
• Ask your supplier how templates are stored, whether they are encrypted, and what happens to them if you change vendors.

Backups, cloud and third parties

Backups contain the same personal data as your live systems, so they need the same care. Encrypt them, restrict access, and apply retention rules.

If you use cloud services or outsource IT, you are still responsible for the data you collect. Check:

• Where the provider stores data
• What security certifications and controls they have
• Who at the provider can access your data
• What your contract says about breaches, deletion and ending the service

Write these expectations into your agreements with IT providers and software vendors.

If there is a breach

Having a plan before an incident is far better than improvising during one. Your plan should cover:

1. Who to call first, and who can disconnect affected systems
2. How to preserve logs and evidence
3. How to work out what data was affected and whose it was
4. Who decides when and how to notify the regulator and affected people, within the timelines the law requires
5. How you will fix the cause and check that it is fixed

Confirm the exact notification duties and timelines with your lawyer or the PDPO, and put them in the plan in writing.

A practical compliance checklist

• We have listed the personal data we hold and where it sits
• We have checked whether we need to register with the Personal Data Protection Office
• Staff and customers are told what we collect and why
• Every user has an individual account with MFA on key systems
• Access to HR, finance, customer and CCTV data is limited by role
• Retention periods are set for CCTV, email, files and backups
• Laptops, backups and removable drives are encrypted
• Cameras and biometric devices use strong credentials, updated firmware and a separate network segment
• Our contracts with IT, cloud and software providers cover data protection
• We have a written breach response plan and have practised it
• Someone is named as responsible for data protection

How Backspace can help

Backspace designs and maintains the networks, CCTV, biometric access, servers and backups that hold your data, with security built into the design rather than added later. A free site assessment will show where personal data is exposed in your systems today and what to fix first. Your lawyer can then confirm the legal side while we handle the technical controls.

Book a free site assessment or call +256 786 394 913.