Data Protection Policy Template Uganda

DATA PROTECTION POLICY TEMPLATE UGANDA

1. DOCUMENT PREAMBLE & RECITALS

THIS DATA PROTECTION POLICY (the "Policy" or "Agreement") is entered into and made effective as of the _____ day of _____________, 20 (the "Effective Date"), by and between:

[Company/Organization Name], a [Corporation/Limited Liability Company/Entity Type] duly organized and existing under the laws of [Jurisdiction], having its principal place of business at [Physical Address] (hereinafter referred to as the "Data Controller" or "Company"); and

[Counterparty/Data Processor Name], a [Corporation/Limited Liability Company/Entity Type] duly organized and existing under the laws of [Jurisdiction], having its principal place of business at [Physical Address] (hereinafter referred to as the "Data Processor" or "Service Provider").

The Data Controller and Data Processor may collectively be referred to as the "Parties" or individually as a "Party."

RECITALS

WHEREAS, the Data Controller collects, processes, stores, and transfers Personal Data in the course of its commercial operations and is subject to the legal and regulatory framework governing data privacy and protection within the Republic of Uganda;

WHEREAS, the Data Processor provides certain services to the Data Controller, which necessitate the processing of Personal Data on behalf of the Data Controller;

WHEREAS, the Republic of Uganda has enacted the Data Protection and Privacy Act, 2019, and the Data Protection and Privacy Regulations, 2021, which establish strict statutory mandates, principles, and obligations regarding the collection, processing, utilization, storage, and protection of Personal Data;

WHEREAS, the Parties intend by this Policy to establish a binding legal framework ensuring full compliance with Ugandan data protection laws, safeguarding the fundamental privacy rights of Data Subjects, and defining the respective duties, liabilities, and operational metrics of the Parties relating to Personal Data;

NOW, THEREFORE, in consideration of the mutual covenants, promises, and statutory obligations contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

---

2. OPERATIONAL DEFINITIONS

For the purposes of this Policy, the following terms shall have the meanings ascribed to them below, and such definitions shall apply to both the singular and plural forms of the terms defined:

1. "Act" means the Data Protection and Privacy Act, 2019 of the Republic of Uganda, as amended, modified, or re-enacted from time to time.
2. "Consent" means any freely given, specific, informed, and unambiguous indication of a Data Subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of Personal Data relating to them.
3. "Data Controller" means a person who, either alone or jointly with other persons or in common with other persons or as a statutory body, determines the purposes for and the manner in which Personal Data is processed or is to be processed.
4. "Data Processor" means any person, other than an employee of the Data Controller, who processes Personal Data on behalf of the Data Controller.
5. "Data Protection Commission" or "Office" means the Personal Data Protection Office established under the Act, or any successor regulatory authority in Uganda exercising supervisory jurisdiction over data protection and privacy matters.
6. "Data Subject" means an identified or identifiable natural person who is the subject of Personal Data.
7. "Personal Data" means any information relating to an identified or identifiable natural person (Data Subject) who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the physical, physiological, mental, economic, cultural, or social identity of that natural person.
8. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
9. "Processing" means any operation or set of operations which is performed on Personal Data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.
10. "Regulations" means the Data Protection and Privacy Regulations, 2021, promulgated pursuant to the Act.
11. "Special Personal Data" means Personal Data relating to a Data Subject's religious or philosophical beliefs, political opinions, sexual life, health status, financial status, or criminal record, as defined under Section 9 of the Act.
12. "Third Party" means any natural or legal person, public authority, agency, or body other than the Data Subject, the Data Controller, the Data Processor, and persons who, under the direct authority of the Data Controller or Data Processor, are authorized to process Personal Data.

---

3. SUBSTANTIVE TERMS & OBLIGATIONS

Clause 3.1 Statutory Compliance and Principles of Processing

1. The Parties shall strictly comply with all mandatory data protection principles enshrined in Section 7 of the Act, ensuring that Personal Data is:
   • Processed lawfully, fairly, and transparently without infringing the privacy of the Data Subject;
   • Collected for specific, explicitly stated, and legitimate purposes and not further processed in a manner incompatible with those purposes;
   • Adequate, relevant, and not excessive in relation to the purpose for which it is collected and processed;
   • Accurate and, where necessary, kept up to date, with every reasonable step taken to ensure that inaccurate data is erased or rectified without delay;
   • Kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the data was collected or further processed; and
   • Processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures.

Clause 3.2 Obligations of the Data Controller

1. The Data Controller warrants and represents that:
   • All Personal Data collected, utilized, or transferred under this Policy has been obtained with valid, lawful, and verifiable Consent from the Data Subject, or is otherwise authorized under Section 8 of the Act;
   • It has provided clear and transparent notice to Data Subjects regarding the identity of the Data Controller, the purpose of collection, categories of recipients, and the rights of Data Subjects;
   • It maintains a lawful registry of data collection and processing activities as mandated by the Act and Regulations.

Clause 3.3 Obligations and Duties of the Data Processor

1. The Data Processor shall process Personal Data exclusively on documented instructions from the Data Controller, including with regard to transfers of Personal Data to a third country or an international organization, unless required to do so by the laws of Uganda.
2. The Data Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. The Data Processor shall implement and maintain appropriate technical and organizational security measures to protect Personal Data against a Personal Data Breach, meeting or exceeding industry standards and the explicit mandates of the Act and Regulations.
4. The Data Processor shall not engage another sub-processor without prior specific or general written authorization of the Data Controller. Where general written authorization is given, the Data Processor shall inform the Data Controller of any intended changes concerning the addition or replacement of sub-processors, thereby giving the Data Controller the opportunity to object to such changes.

Clause 3.4 Data Subject Rights Management

1. The Parties shall cooperate to facilitate the immediate exercise of Data Subject rights under the Act, including:
   • The right of access to confirmation as to whether or not Personal Data concerning them is being processed;
   • The right to rectification of inaccurate or incomplete Personal Data;
   • The right to erasure, blocking, or destruction of Personal Data where the data is no longer necessary, where Consent is withdrawn, or where processing is unlawful;
   • The right to object to the processing of Personal Data for direct marketing or profiling purposes.
2. Any request received by the Data Processor from a Data Subject concerning their Personal Data shall be redirected to the Data Controller within [Number] hours of receipt, and the Data Processor shall not independently respond to such request unless expressly authorized in writing by the Data Controller.

Clause 3.5 Cross-Border Transfer of Personal Data

1. No Personal Data collected within the territory of the Republic of Uganda shall be transferred to a country outside Uganda unless the transfer complies strictly with the requirements of Section 19 of the Act and Regulations.
2. Such cross-border transfers are permissible only where:
   • The recipient is subject to a law, binding corporate rules, contractual clauses, or an international agreement that affords an adequate level of protection that is at least equivalent to the data protection standards provided under the Act; or
   • The Data Subject has given explicit, informed, and unambiguous Consent to the transfer after being informed of the possible risks of such transfers due to the absence of adequate protection.

---

4. DEFAULT, TERMINATION, AND REMEDIES

Clause 4.1 Breach Classifications

1. Material Breach: Any failure by either Party to comply with the mandatory provisions of Sections 3.1, 3.3, 3.5, or any unauthorized disclosure, wholesale loss, or widespread compromise of Personal Data shall constitute a Material Breach of this Policy and the underlying commercial agreement.
2. Minor Breach: Any administrative, procedural, or technical discrepancy that does not directly expose Personal Data to imminent risk of unauthorized access or disclosure shall constitute a Minor Breach.

Clause 4.2 Notice and Cure Periods

1. In the event of a Minor Breach, the non-defaulting Party shall issue a written notice of default specifying the particulars of the breach. The defaulting Party shall have thirty (30) business days from the date of receipt of such notice to cure the breach to the reasonable satisfaction of the non-defaulting Party.
2. In the event of a Material Breach, particularly involving a Personal Data Breach or unlawful cross-border transfer, the non-defaulting Party may, at its sole discretion, demand an immediate cure within forty-eight (48) hours or terminate this Policy immediately without prior notice.

Clause 4.3 Mandatory Breach Notification Protocol

1. In the event of a confirmed or reasonably suspected Personal Data Breach, the Data Processor shall notify the Data Controller in writing within twenty-four (24) hours of becoming aware of the breach.
2. The notification shall contain, at a minimum:
   • A description of the nature of the Personal Data Breach, including categories and approximate number of Data Subjects concerned;
   • The name and contact details of the Data Protection Officer or other contact point where more information can be obtained;
   • The likely consequences of the Personal Data Breach; and
   • The measures taken or proposed to be taken by the Data Processor to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects.
3. The Data Controller shall be solely responsible for notifying the Data Protection Commission and affected Data Subjects within the statutory timeframes mandated by Ugandan law (typically within 72 hours of becoming aware of the breach).

Clause 4.4 Legal Recourse, Indemnification, and Remedies

1. Each Party (the "Indemnifying Party") shall defend, indemnify, and hold harmless the other Party, its officers, directors, employees, and agents (the "Indemnified Party") from and against any and all claims, liabilities, losses, damages, fines, penalties, regulatory sanctions imposed by the Data Protection Commission, costs, and expenses (including reasonable legal fees) arising out of or resulting from any Material Breach of this Policy or violation of the Act by the Indemnifying Party or its personnel.
2. Termination of this Policy for any reason shall not relieve either Party from any liability or obligation that accrued prior to such termination, nor shall it prejudice any other remedies available to the non-defaulting Party under Ugandan law.

---

5. BOILERPLATE LEGAL PROVISIONS

Clause 5.1 Severability

If any provision of this Policy is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction or the Data Protection Commission, such provision shall be modified to the minimum extent necessary to make it valid and enforceable. If modification is not possible, the provision shall be deemed severed from this Policy, and the remaining provisions shall continue in full force and effect.

Clause 5.2 Entire Agreement

This Policy, together with any underlying commercial service agreements and Data Processing Addenda, constitutes the entire agreement between the Parties concerning the subject matter hereof and supersedes all prior oral or written representations, negotiations, understandings, or agreements between the Parties relating to data protection in Uganda.

Clause 5.3 Force Majeure

Neither Party shall be liable for any failure or delay in the performance of its obligations under this Policy if such failure or delay is caused by acts of God, natural disasters, war, terrorism, civil unrest, labor strikes, widespread internet or telecommunications infrastructure failures, or binding governmental orders, laws, or regulations (excluding regulatory fines or penalties arising from a Party's own operational negligence), provided that the affected Party gives prompt written notice to the other Party and uses all commercially reasonable efforts to mitigate the effects of the force majeure event.

Clause 5.4 Governing Law

This Policy, and all claims or causes of action (whether in contract, tort, or statute) that may be based upon, arise out of, or relate to this Policy, shall be governed by, enforced under, and construed in accordance with the laws of the Republic of Uganda, without regard to its conflict of laws principles. The Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021 shall apply as paramount statutory standards.

Clause 5.5 Dispute Resolution

1. Amicable Negotiation: In the event of any dispute, controversy, or claim arising out of or relating to this Policy, including its formation, breach, termination, or validity, the Parties shall first attempt in good faith to resolve the dispute through senior management negotiations within thirty (30) days of a written dispute notice being issued by one Party to the other.
2. Arbitration: If the dispute is not resolved through amicable negotiation within the stipulated thirty (30) day period, the dispute shall be finally settled by binding arbitration in Kampala, Uganda, in accordance with the Arbitration and Conciliation Act, Cap 4 (Laws of Uganda). The arbitral tribunal shall consist of a single arbitrator agreed upon by the Parties, or failing agreement within fourteen (14) days, appointed by the Chairman of the Centre for Arbitration and Dispute Resolution (CADR). The language of the arbitration shall be English, and the arbitral award shall be final and binding upon the Parties.
3. Court Jurisdiction: Subject to the arbitration provisions above, the Parties irrevocably submit to the exclusive jurisdiction of the Courts of the Republic of Uganda located in Kampala for the purposes of enforcing any arbitral award or for seeking urgent interlocutory injunctive relief.

---

6. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties hereto have caused this Data Protection Policy to be duly executed by their respective authorized representatives as of the Effective Date written above.

DATA CONTROLLER:

[Company Name]

By: _____________________________________
Name: ___________________________________
Title: ____________________________________
Date: ____________________________________

WITNESSED BY:
Signature: _______________________________
Name: ___________________________________
Address: _________________________________

DATA PROCESSOR:

[Counterparty/Data Processor Name]

By: _____________________________________
Name: ___________________________________
Title: ____________________________________
Date: ____________________________________

WITNESSED BY:
Signature: _______________________________
Name: ___________________________________
Address: _________________________________