PDPO Compliance Report: Ugandan SME Checklist
Uganda's data protection regulator now enforces real penalties. What the annual compliance report involves, who must file, and an IT-side checklist for SMEs.
Data protection in Uganda stopped being theoretical in 2026. The Personal Data Protection Office (PDPO) under NITA-U has moved from registration drives to enforcement, including reported criminal convictions against data handlers earlier this year. Corporate penalties can reach up to 2% of annual turnover.
If your business collects customer records, staff files, CCTV footage or biometric data, two dates matter: your registration status, and the annual compliance report — widely reported as due on 23 November each year.
This article is general information from an IT infrastructure provider. It is not legal advice. Confirm your exact obligations, deadlines and filing requirements with a qualified Ugandan lawyer or directly with the Personal Data Protection Office.
Who this applies to
The Act covers organisations that collect or process personal data as controllers or processors. In practice that includes:
- Shops and chains running loyalty programmes or POS customer records
- Hotels with guest registration systems
- Clinics, schools and NGOs holding beneficiary or student data
- Employers — payroll, national ID numbers, bank details, biometric attendance
- Any business running CCTV that captures identifiable people
If you have not checked your registration status, start there. An IT audit cannot substitute for legal registration, but it produces the evidence the process asks for.
What the IT side of compliance looks like
| What the regulator expects | What that means in your systems |
|---|---|
| Lawful, limited collection | Forms and systems collect only what is needed |
| Security safeguards | Firewalls, endpoint protection, encryption, access control |
| Access limited by role | Individual accounts, MFA, regular permission reviews |
| Retention limits | Automatic deletion policies on CCTV, email, backups |
| Breach readiness | Logging, monitoring, a written incident plan |
| Ability to find a person's records | Documented data map across systems |
| Care when data crosses borders | Knowing where cloud providers store data |
We covered the full IT checklist in our Data Protection Act guide. This article focuses on what changes when you have to show evidence, not just claim good intentions.
Building the evidence trail
Enforcement turns "we take security seriously" into "show us". The artefacts that matter:
1. A data map. What personal data you hold, where it sits (servers, cloud, laptops, backups), who can access it, and how long you keep it. This is a spreadsheet, not a project — but it must be current.
2. Access review records. A dated list of who has access to HR, finance, CCTV and customer systems, signed off by a manager. Former staff removed, with dates.
3. Configuration evidence. Screenshots or exports showing MFA enabled, CCTV retention set to a defined period, backups encrypted, guest Wi-Fi segmented from office systems.
4. Vendor documentation. What your cloud, software and IT providers do about data protection, where data is hosted, and what your contract says about breaches.
5. A written incident plan. Who to call, how to preserve logs, how to assess what data was affected, who notifies the regulator and affected people. Practised at least once.
CCTV and biometrics deserve extra attention
Two systems generate the most regulator questions:
- CCTV: defined retention period (let old footage overwrite automatically), signed notices where cameras operate, restricted export permissions, and no default passwords on recorders.
- Biometric attendance and access: consent or lawful basis recorded, templates encrypted, readers on a separate network segment, and a process to delete data when someone leaves.
Exposed or default-password camera systems are the single most common finding on our site assessments. They are also the fastest to fix.
If the deadline is close
A sensible order when the report window is opening:
- This week: confirm your registration status with the PDPO or your lawyer. If you are not registered, that conversation happens now, not in the report.
- Next two weeks: build or refresh the data map. It is the backbone of every answer that follows.
- Next month: close the technical gaps the map reveals — retention settings, MFA, offboarding, backup encryption.
- Before filing: have your lawyer review the final pack. The IT evidence we produce is built to sit inside that review, not replace it.
Get the technical evidence produced properly
Backspace builds the technical side of compliance: data-flow-aware network design, CCTV and biometric systems configured with retention and access control from day one, encrypted backups, and documented access reviews. A free site assessment shows what evidence you could produce today and what is missing.
Book a free site assessment or call +256 786 394 913.
Frequently Asked Questions
What IT compliance standards apply to my business?▼
How can I ensure my IT procurement follows best practices?▼
What should be included in an IT procurement contract?▼
How often should I review my IT compliance status?▼
What are the penalties for non-compliance with IT regulations?▼
Continue reading
More articles in Compliance & Procurement →Not sure which of this applies to you?
Reading about a problem is not the same as knowing what yours actually is. The Solution Advisor asks a few questions about your environment and gives you a preliminary technical interpretation — what to check first, and what can probably wait.
Follow Backspace
Field notes from live projects in Kampala and beyond — new guides, failure post-mortems and pricing updates. Pick the channel you use.
