Uganda’s Personal Data Protection Office (PDPO) has issued a landmark decision finding Google LLC in violation of the country’s Data Protection and Privacy Act, Cap 97, and its Regulations. The ruling orders Google to register as a data controller and collector within 30 days and to demonstrate compliance controls over the transfer of Ugandan users’ personal data abroad.
The ruling, delivered on July 18 by Uganda’s Personal Data Protection Office, gives Google 30 days to comply and signals a growing willingness by African regulators to assert jurisdiction over global tech companies operating in local markets.
The case stems from a complaint filed in November 2024 by four Ugandan citizens—Ssekamwa Frank, Leni Sharon Pamela, Amumpaire Raymond, and Awino Mercy—who accused Google of operating in Uganda without proper registration and unlawfully transferring personal data across borders without adequate safeguards.
PDPO found that Google “collects various categories of personal data, including names, nationality, email addresses, age, date of birth, unique online identifiers, browsing history, and location data” from Ugandan users. The office ruled that Google “determines the purposes and means for which this personal data is processed,” qualifying the company as both a data controller and a data collector under Uganda’s data protection law.
Google had argued that it was not obligated to register until Uganda’s data authority explicitly exempted or mandated registration through a formal notice. But the regulator rejected this reading, citing legal precedent that general statutory rules remain binding until specific exemptions are officially issued. “Registration is the rule, not the exception,” the decision states.
The authority further determined that Google’s transfer of personal data outside Uganda breached Section 19 of the Act and Regulation 30, noting that Uganda’s data protection law has extraterritorial reach. “Google LLC is not a remote or incidental actor,” PDPO stated, citing evidence of Google’s taxpayer registration and VAT remittances to the Uganda Revenue Authority, which establishes a commercial presence within the country and grounds for regulatory compliance.
The complainants highlighted that Google’s failure to register deprived them of a Data Protection Officer contact point, leaving their concerns unaddressed despite attempts, including a formal email sent to Google’s Chief Compliance Officer on October 9, 2024, which went unanswered. PDPO found this lack of transparency “caused and is likely to continue causing genuine distress” to Ugandan users.
PDPO further noted that it lacks authority to award compensation or damages, advising any claims for distress be pursued through the courts. The ruling grants the complainants’ request for declarations validating Google’s status and violations, and reserves the right to issue further compliance orders.
Failure to comply may attract daily fines or imprisonment. Either party may appeal the decision to the Minister of ICT and National Guidance within 30 days.
This decision marks Uganda’s first major enforcement under its data protection framework and sets a precedent for how global tech companies must adhere to local data privacy laws in African markets.
As regulators across Africa adopt and begin enforcing data protection laws, the ruling could have far-reaching implications for how international tech platforms manage user data in emerging markets. Uganda’s decision underscores a broader global trend: digital advertising operations are facing growing scrutiny from privacy authorities, especially where real-time bidding systems and opaque data flows are involved.
