Uganda cookie consent and the Data Protection and Privacy Act

The DPPA is Uganda's Data Protection and Privacy Act, 2019, the country's general data protection law. It has no separate cookie rule, but section 7 bars collecting or processing personal data without the data subject's prior consent, so cookies that collect personal data, such as analytics and advertising cookies, need consent before they are set. The Act also reaches organisations outside Uganda that handle the personal data of Ugandan citizens.

Uganda's Data Protection and Privacy Act 2019

The Data Protection and Privacy Act was assented to in February 2019 and came into force on 3 May 2019, which made Uganda one of the first East African countries with a comprehensive data protection law. The Data Protection and Privacy Regulations 2021 add detail on registration, complaints and procedure.

The Personal Data Protection Office (PDPO), within the National Information Technology Authority - Uganda (NITA-U), supervises the Act. It keeps the data protection register, investigates complaints and can direct organisations to remedy a breach.

Section 1 applies the Act to anyone collecting, processing, holding or using personal data in Uganda, and to anyone outside Uganda who does so with personal data relating to Ugandan citizens. In a decision of 18 July 2025, the PDPO found Google LLC in breach of the Act and ordered it to register within 30 days, confirming that the obligations attach to foreign entities that process Ugandan citizens' data.

How the DPPA defines consent for cookies

Section 2 defines consent as "any freely given, specific, informed and unambiguous indication" of the data subject's wish, given "by a statement or by a clear affirmative action". This matches the definition in the GDPR, and section 7(1) requires that consent before personal data is collected or processed.

Cookies that collect personal data, such as _ga from Google Analytics, _fbp from Meta or other advertising identifiers, fall within that rule. A visitor from Uganda should be able to agree before they are set.

When consent is not needed

Section 7(2) lists cases where personal data may be processed without consent: where the law authorises or requires it, where it is necessary for a public body's duty, national security or preventing and prosecuting offences, for medical purposes, to meet a legal obligation, and to perform a contract with the data subject or take steps they asked for before one. The Act never uses the term "strictly necessary", but the contract ground can cover a session cookie such as PHPSESSID that keeps a cart or a login working.

Conditions for valid consent

Consent has to be informed, so visitors need to know what is collected and why, and specific, so one agreement cannot cover unrelated purposes. Section 7(3) lets a data subject object to processing that relies on consent, and the organisation must then stop. In practice, that means a cookie consent banner that names the cookies and their purposes, lets visitors accept or reject each category and keeps optional cookies off until they choose.

Registering with the PDPO

Section 29 requires the Authority to keep a data protection register and to enter in it every person, institution or public body collecting or processing personal data, with the purpose of the processing. Applications follow the procedure set in the 2021 Regulations.

The PDPO's Google decision turned on this register. According to a law-firm summary of the decision, the PDPO confirmed that every data collector, processor or controller must register and renew every year, including entities abroad that handle Ugandan citizens' data, until it gazettes a specific exemption. The same summary puts the registration fee at UGX 100,000 and says registration is done online.

Cross-border data transfers

Section 19 covers a data processor or controller based in Uganda that processes or stores personal data outside Uganda. It must make sure the destination country has protection at least equivalent to the Act's, or that the data subject has consented.

Cookies matter here because analytics and advertising services usually send data to servers abroad. If you are based in Uganda and use _ga or _fbp, document why the transfer meets section 19 and say so in your cookie policy. In the Google decision, the PDPO also asked for documentary evidence of how cross-border transfers of Ugandan citizens' data comply with the Act.

Penalties under the DPPA

The Act's sanctions are criminal and are imposed by courts on conviction. One currency point is worth UGX 20,000 under the Act's Schedule.

Section 38 adds corporate liability. When a corporation commits the offences it covers (its text refers to sections 31 and 32), the corporation and every officer who knowingly authorised the breach are liable, and a convicting court may also order the corporation to pay a fine of up to 2% of its annual gross turnover. That 2% is a court power on top of the punishment, not an administrative fine the PDPO sets.

For trackers, section 35 is the most relevant offence, since passing visitor data to a third party without a lawful basis can amount to unlawful disclosure. Data subjects who suffer damage or distress can also claim compensation in court under section 33.

The DPPA compared with the GDPR and other African laws

The DPPA and the GDPR define consent in almost the same words and give data subjects similar rights, including access, correction and deletion. They differ on enforcement. The GDPR lets regulators impose administrative fines of up to EUR 20 million or 4% of worldwide turnover. The DPPA relies on criminal fines, prison terms of up to 10 years and the court-ordered 2% corporate fine.

Among Uganda's neighbours, Kenya's Data Protection Act 2019 and Tanzania's data protection framework follow similar consent-based models. In West Africa, Nigeria's Data Protection Act 2023, which now sits above the earlier NDPR, and Ghana's Data Protection Act 2012 take comparable approaches. The privacy laws by region overview puts them side by side.

A checklist for websites with Ugandan visitors

Audit your cookies

Run a cookie scan to find every cookie your site sets. Sort each into strictly necessary, functional, analytics or advertising, and note its purpose, duration and any third party involved.

Show a consent banner

Show a banner before non-essential cookies are set, explain what they do and let visitors accept or reject each category. Pre-ticked boxes are not a "clear affirmative action" under section 2.

Block cookies until visitors choose

Analytics and advertising tags must not run before consent. Script blocking holds them back until the visitor makes a choice.

Keep a cookie policy

List each cookie by name with its purpose, duration and whether data leaves Uganda, and link the policy from the banner.

Register with the PDPO

If you collect personal data from Ugandan users, including through cookies, register with the Personal Data Protection Office and renew the registration every year.

Document cross-border transfers

Where cookie data goes to servers outside Uganda, record the safeguards you rely on, such as contract clauses with your vendors or the destination country's level of protection.

Questions about cookie consent in Uganda

Give visitors from Uganda a choice before cookies load

Kukie.io scans your site, sorts the cookies it finds into categories, blocks optional ones until visitors choose and keeps a record of each choice.

Start free