Compliance FrameworksMiddle East & Africa
Uganda Data Protection and Privacy Act 2019
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | UG DPPA |
| Region | Middle East & Africa |
| Country or scope | Uganda |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers UG DPPA
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
UG-DPPA-20 Security of Data | Controllers and processors must secure the integrity of personal data by adopting appropriate technical and organisational safeguards against loss, damage and unauthorised access, evidenced by integrity hashes on processing components (DPPA 2019, s. 20) | Scan |
UG-DPPA-BRN Breach Notification Readiness | Unauthorised access to or acquisition of personal data must be notified to the Personal Data Protection Office, which requires affected components to be quickly identifiable (DPPA 2019, s. 23 breach notification) | Scan |
UG-DPPA-PROC Processor Oversight | A data processor may only process on the controller's instructions under adequate safeguards, so third-party software components must have named suppliers (DPPA 2019, processor obligations, Part IV) | Scan |
UG-DPPA-REG Registration and Accountability Records | Controllers must register with the Personal Data Protection Office and account for their processing, which presupposes an inventory of the software systems that process personal data (DPPA 2019, registration provisions and Regulations 2021) | Scan |
UG-DPPA-DOC Demonstrable Documentation | Accountability to the regulator requires software records to be identifiable, timestamped documents whose creator is recorded (DPPA 2019, accountability principle, s. 3) | Scan |
Policy templates
All 22 from the standard set, adapted to UG DPPA.