Skip to main content

    AI by country · East Africa

    AI in Uganda: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Uganda know before starting with AI?

    Uganda has no dedicated AI law as of 29 October 2026. The Data Protection and Privacy Act, 2019 is the law that applies to AI today, and anyone collecting or processing personal data must register with the Personal Data Protection Office. A company should register, decide which AI decisions about people need a human check, and confirm the rules before storing data outside Uganda.

    At a glance

    Uganda at a glance

    Key facts about Uganda
    Data protection lawData Protection and Privacy Act, 2019 (Act 9 of 2019, now Cap. 97), in force since 3 May 2019
    RegulatorPersonal Data Protection Office (PDPO), within the National Information Technology Authority - Uganda (NITA-U)
    AI policyNational AI and Emerging Technologies Strategy in development; not launched as of 29 October 2026. No dedicated AI law
    Time zoneEAT, UTC+3 (India is 2.5 hours ahead)
    CurrencyUGX (Ugandan shilling)
    Business languageEnglish and Kiswahili

    Why now

    Why Uganda is worth watching

    Each point links to the document it comes from.

    • The Data Protection and Privacy Act, 2019 was assented to on 25 February 2019 and commenced on 3 May 2019.[1]

    • The Ministry of ICT and National Guidance is developing a National AI and Emerging Technologies Strategy, with AI as the flagship, after a Cabinet directive to develop an AI policy.[2]

    • The strategy's consultations in early 2026 covered agriculture, health, finance, education, tourism, manufacturing and research.[2]

    • The ministry launched a five-year National Data Strategy in October 2026 and described the National AI Strategy as upcoming.[3]

    • In April 2026 the ministry said the AI strategy would follow the Data Strategy and cover AI, blockchain, the Internet of Things and robotics.[4]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Data Protection and Privacy Act, 2019: automated decisions and breaches

    In force2019A person can require that a decision significantly affecting them is not based solely on automated processing. Where it is, the controller must tell them, and they have 21 days to ask for reconsideration (section 27). The section does not apply to decisions made when considering, entering into or performing a contract, or when authorised by law. A breach must be reported to the regulator immediately, and the regulator decides whether people must be told (section 23).[1]

    Data Protection and Privacy Act, 2019: registration, data abroad and offences

    In force2019Every person or body collecting or processing personal data must be on the data protection register (section 29). A Uganda-based controller or processor that stores or processes data abroad must make sure the country has protection at least equal to the Act, or have the person's consent (section 19). Unlawful disclosure or sale of personal data carries fines of up to 240 or 245 currency points (one point is UGX 20,000) or prison, and courts can add up to 2% of a company's annual gross turnover (sections 35 to 38).[1]

    Data Protection and Privacy Regulations, 2021

    In force2021A legal information service reports that registration lasts 12 months, renewal is due at least three months before expiry, and the application fee was UGX 100,000 in 2021. We could not open the regulation text ourselves, so check current rules with the PDPO.[5]

    National AI and Emerging Technologies Strategy

    Draft2026It was targeted for finalisation in mid-2026 but had not been launched by 21 October 2026. It is a strategy, not a law, so it will not on its own create duties for companies.[3]

    Where AI fits first

    Where AI fits first

    Banking and mobile money

    Fraud detection, credit risk review and customer service in English and Kiswahili.

    Section 27 does not cover decisions made when entering a contract, which may include credit. A human review route is still good practice. Finance was one sector consulted on the AI strategy.[2]

    Agriculture

    Crop disease detection from photos and market price advice for farmers.

    Agriculture is named as an NDP IV priority sector in the AI strategy work. We found no AI rule specific to agriculture.[2]

    Health care

    Summarising patient records and triage support, with clinicians making decisions.

    Health data is personal data under the Act, and storing it abroad needs equal protection or consent under section 19.[1]

    Public sector

    Document search and drafting tools for staff, with human checks.

    The new National Data Strategy aims to change how government institutions collect, store and share data.[3]

    Your first steps

    Your first steps

    1. Register with the PDPO before collecting or processing personal data, and diary the yearly renewal.
    2. List each AI decision that significantly affects a person, and set up a way to notify them and reconsider within 21 days.
    3. Check where your AI tools store data. If it is outside Uganda, confirm equal protection in that country or get consent.
    4. Prepare a breach process that reports to the PDPO immediately and records the remedial action taken.
    5. Keep security measures documented, since section 20 requires you to identify risks and keep safeguards.
    6. Watch the Ministry of ICT and National Guidance for the AI and Emerging Technologies Strategy.

    AI services for Uganda

    AI consulting and development for teams in Uganda

    We work remotely with companies in Uganda, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Uganda is on UTC+3 and India on UTC+5:30, a 2.5 hour gap. Taking a 9:00 to 17:00 day in Uganda and 9:30 to 18:30 in India, the overlap is about 7 hours, from 09:00 to 16:00 Ugandan time.

    Questions

    Common questions about AI in Uganda

    Does Uganda have an AI law?

    Not as of 29 October 2026. A National AI and Emerging Technologies Strategy is in development but had not been launched by 21 October 2026. The Data Protection and Privacy Act, 2019 applies to AI that uses personal data.

    Can I use a cloud AI service hosted abroad?

    Yes, if section 19 is met. The country where data is stored or processed must have protection at least equal to Ugandan law, or the person must have consented.

    How fast must I report a data breach?

    Immediately, under section 23. The Act gives no number of hours. The regulator then decides whether you must notify the people affected.

    What are the penalties?

    Offences such as unlawful disclosure carry fines of up to 240 currency points, which is UGX 4.8 million, or up to ten years in prison. A court can also fine a company up to 2% of its annual gross turnover.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Republic of Uganda, via ULII and Laws.Africa, 2019-05-03. Data Protection and Privacy Act (Chapter 97), Act 9 of 2019(media.ulii.org)
      Full title and what we used it for

      Data Protection and Privacy Act (Chapter 97), Act 9 of 2019. Primary law text as gazetted. Read in full. Used for assent and commencement dates, and sections 4, 19, 20, 23, 27, 29 and 35 to 38. ULII notes the collection was last checked for updates on 31 December 2023.

    2. [2] Ministry of ICT and National Guidance, 2026-03-13. Ministry engages stakeholders on Uganda's National Emerging Technologie…(ict.go.ug)
      Full title and what we used it for

      Ministry engages stakeholders on Uganda's National Emerging Technologies Strategy. Primary. Used for the strategy's origin in a Cabinet directive, AI as flagship, NDP IV sectors and sectors consulted.

    3. [3] Daily Monitor, 2026-10-21. Government launches five-year data strategy ahead of AI adoption(monitor.co.ug)
      Full title and what we used it for

      Government launches five-year data strategy ahead of AI adoption. Press report. Used for the National Data Strategy launch and that the AI strategy was still upcoming.

    4. [4] Daily Monitor, 2026-04-01. Govt AI strategy will be ready by June, says ICT ministry(monitor.co.ug)
      Full title and what we used it for

      Govt AI strategy will be ready by June, says ICT ministry. Press report of remarks by the ministry's Permanent Secretary. Used for the strategy's scope and its sequence after the Data Strategy.

    5. [5] Afriwise, 2021-12-08. Beat the data protection registration deadline(afriwise.com)
      Full title and what we used it for

      Beat the data protection registration deadline. Legal information service, used for interpretation of the 2021 Regulations only: 12-month registration, renewal timing and the 2021 fee. Not verified against the regulation text.

    6. [6] Centre for Intellectual Property and Information Technology Law (CIPIT), Strathmore University, 2026-04-03. Development of the National AI Strategy for Uganda(cipit.strathmore.edu)
      Full title and what we used it for

      Development of the National AI Strategy for Uganda. Academic policy brief. Used as background on the lack of a coordinated national AI strategy as of April 2026.

    This is general information, not legal advice. Our law text may not show amendments after 2023, and the regulation details come from a secondary source. Check with a qualified Ugandan lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Uganda?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score