“Uganda orders Google to register as data processor in landmark privacy ruling”, 20th July 2025

Uganda's Personal Data Protection Office has issued a landmark ruling ordering Google LLC to register as a data controller and collector within 30 days, marking the first major enforcement action under the country's data protection framework. The decision, announced on July 18, 2025, establishes significant precedent for how global technology companies must comply with local data protection laws in African markets. According to the Personal Data Protection Office decision, four Ugandan citizens filed complaint number 08/11/24/6683 on November 8, 2024, alleging Google violated Uganda's Data Protection and Privacy Act by operating without proper registration and transferring personal data outside Uganda without adequate safeguards. The complainants - Ssekamwa Frank, Leni Sharon Pamela, Amumpaire Raymond, and Awino Mercy - sought declarations, orders for compliance, and compensation for distress caused by Google's alleged violations. The regulatory authority determined that Google qualifies as both a data controller and collector under Ugandan law. According to the ruling, Google collects various categories of personal data from Ugandan users, including "names, nationality, email addresses, age, date of birth, unique online identifiers, browsing history, and location data." The office found that Google "determines the purposes and means for which this personal data is processed," thereby meeting statutory definitions under the Data Protection and Privacy Act…

Google argued that registration requirements were inoperative without a specific exemption notice from the data protection office. According to the decision, Google contended that Regulation 15(2) allows the PDPO to exempt certain categories from registration through gazette notices, and since no such notice existed, the mandatory registration requirement was suspended. The Personal Data Protection Office rejected this interpretation. According to the ruling, the office found "the legal structure is clear: the general rule is that registration is mandatory, unless and until a specific exemption is operationalized by way of gazette notice." The decision cited Total Uganda Limited v. Uganda Revenue Authority, where courts held that general statutory rules remain operative until exemptions are expressly invoked through proper procedures. The ruling establishes that Google's non-registration constitutes a violation of Section 29 of the Data Protection and Privacy Act and Regulation 15 of the accompanying regulations. According to the decision, this finding applies regardless of Google's argument about exemption procedures.

The Personal Data Protection Office also ruled against Google's cross-border data transfer practices. According to the decision, Google "failed to provide evidence of a lawful basis or compliance framework for transferring the Complainants' personal data outside Uganda." The office found this constituted violations of Section 19 of the Act and Regulation 30 of the regulations… The Uganda decision carries significant implications for digital marketing operations across emerging markets. Data protection enforcement has intensified globally, with recent rulings affecting major technology platforms' advertising practices… For digital advertising professionals, the decision highlights evolving compliance requirements in African markets. Google has faced increasing scrutiny over data practices, with regulators examining real-time bidding systems and cross-border data transfers. The Uganda ruling demonstrates how local data protection authorities are asserting jurisdiction over global platforms serving local users…