The short answer: accountability follows the data controller
Uganda's Data Protection and Privacy Act 2019 (Cap. 97) and its 2021 Regulations apply to any organization that processes personal data of Ugandan residents, whether the processor is based in Uganda or abroad. The first obligation is registration with the Personal Data Protection Office (PDPO). Cross-border transfers are permitted, but only if the destination country offers equivalent protection or you obtain the data subject's consent. There is no pre-approval required for each transfer, but the controller must maintain documentation of the legal basis, safeguards, and justification — a point the PDPO reinforced in its August 2025 guidance. Local storage is not the default; defensible documentation is.
Data residency is not automatically local storage
A common misunderstanding is that compliance means keeping servers in Uganda. The law does not require all personal data to be stored locally. What it requires is a lawful basis and appropriate safeguards for processing, wherever the infrastructure sits. You may choose local storage for latency, sovereignty, or commercial reasons, and Uganda has a growing local cloud option in ABQ Cloud, launched in February 2026. But choosing a foreign cloud provider is not by itself a violation. The compliance question is whether you can show why the data is where it is and how it is protected.
Two legal routes for cross-border transfer
- The destination country has an adequate level of protection equivalent to Uganda's framework.
- The data subject has given explicit, informed consent to the transfer.
Neither route removes your documentation burden. In practice, this means you should be able to produce, on request, the legal basis you relied on, the safeguards in place, and a clear mapping of what personal data leaves Uganda, to whom, and for what purpose.
What the PDPO's 2025 Google finding should teach you
In 2025, the PDPO found Google non-compliant for a lack of evidence supporting its cross-border data transfer justifications. This was not a ban on using Google services, but it is a clear signal: a globally recognized vendor does not automatically satisfy Uganda's documentation requirements. Contractual promises and marketing language are not the same as demonstrable compliance. If your cloud vendor cannot show you the legal basis and safeguards for your specific data flows, treat that as a red flag in due diligence.
Do not accept 'we are compliant' at face value
Ask the vendor to specify, in writing, the legal basis for each cross-border transfer of your Ugandan personal data, where the data will reside, how it is encrypted, and how they will cooperate with the PDPO. If the answer is vague, escalate or walk away.
The shared-responsibility model: outsourcing infrastructure does not outsource accountability
Cloud providers operate on a shared-responsibility model: they secure the infrastructure, but you, as the data controller, remain accountable for the personal data processed on it. The DPA does not let you delegate that accountability to a vendor. Your contract and SLAs should therefore specify data residency options, encryption standards, incident response obligations, and cooperation with PDPO investigations. Without those clauses, you may inherit the risk while holding little leverage to verify what the vendor actually does.
This is the same evidence-first discipline we recommend for any high-stakes vendor relationship. Our due diligence guide for Ugandan businesses walks through a structured way to verify claims before you commit — a method that transfers directly to cloud procurement.
A simple evaluation framework for cloud vendor compliance
You do not need to become a data protection lawyer to make a defensible decision. A structured evaluation against a set of criteria will surface most material gaps:
- Map your personal data flows and identify the lawful basis for processing and any cross-border transfer.
- Confirm the vendor's own PDPO registration and ask for evidence, not a statement.
- Assess the transfer mechanism: equivalent protection, consent, or another documented justification.
- Review contractual SLAs for data residency options, encryption, incident response, and PDPO cooperation.
- Document your due diligence and schedule a periodic review, especially when adding new services or regions.
When cloud services are part of a public tender, the same documentation rigour applies. Uganda's e-GP 2.0 registration requirements explain what government buyers now expect from bidders, including cloud and IT services.
How data governance fits your AI and software buying decisions
Data residency is not a stand-alone compliance exercise. It is the foundation for any AI or analytics investment you make next. Uganda's AI sovereignty strategy, announced in June 2026, and the planned Karuma AI supercomputing hub point toward a more local, deliberate approach to data and compute. If you are evaluating AI-enabled tools, the same documentation discipline applies: you need to know where your prompts, customer records, and model training data will live. For the strategic implications, see Uganda's AI sovereignty push and your 2026 software buying decisions.