It is reported that the Central Bank of Uganda interprets the country's cybersecurity legislation as giving it the power to require financial institutions to relocate their data centres to Uganda in order to provide the government with access to customers' digital financial information. It is also reported that regulated financial institutions are currently implementing this policy.

Section 19 of the Data Protection and Privacy Act stipulates that in the event that a data processor or data controller based in Uganda processes or stores personal data outside Uganda, the data processor or data controller must ensure that the country in which the data is processed or stored has in place adequate measures for the protection of personal data at least equivalent to the protection provided for by this Act, or that the data subject has consented. In addition, Regulation 30 of the Data Protection and Privacy Regulations provides further details, including that any personal data processed outside Uganda shall not be further transferred to or processed in a third country without the express consent of the data subject.

Uganda has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Data Protection and Privacy Act provides a comprehensive regime of data protection in Uganda. It, in particular, provides for a data protection and privacy register and processes for the investigation of complaints relating to the infringement of data subject rights under the Act. In addition, the Act establishes consent as a central principle, specifies conditions for consent relating to minors as well as other special categories, and, notably, has extraterritorial scope and may apply to entities outside Uganda.

Art. 6 of the Data Protection and Privacy Act mandates that institutions must appoint a Data Protection Officer (DPO). While the Act does not provide further details on the appointment, these are clarified in the Data Protection and Privacy Regulations, 2021. Specifically, the Regulations state that any individual, institution, or public body involved in processing or controlling personal data must designate a DPO if (Section 47.2):
- the activities of the person, institution or public body, consist of processing operations which by virtue of their nature, scope or purpose require regular and systematic monitoring of data subjects on a large scale; or
- consist of processing of special personal data in accordance with the Data Protection and Privacy Act.
Furthermore, according to Section 12 of the Regulations, where the collection or processing of personal data poses a high risk to the rights and freedoms of natural persons, the data collector, data processor, or data controller shall, prior to the processing and/or collection, carry out an assessment of the impact of the envisaged collection or processing operations on the protection of personal data.

Section 7 of the Data Protection and Privacy Act provides that, where necessary for the proper performance of a public duty by a public body, cases of national security or for the prevention, detection, investigation, prosecution, or punishment of an offence or breach of law, or for medical purposes, the public authority may collect data even at the objection of the data subject. It is not clarified whether a court order is needed. It is reported that the flexibility provided by the Act is not abused by the authorities, which limited its use to contain health emergencies.

Under Section 11 of the Trade Secrets Protection Act No. 2 of 2009, trade secrets may be required to be submitted to a government department, but the department must protect the information submitted to it from disclosure.

The Trade Secrets Protection Act No. 2 of 2009 provides a framework for effective protection of trade secrets.

According to Section 9 of the Uganda Communications Commission Guidelines on Communications Infrastructure Deployment and Sharing, all licensed operators are required to coordinate and/or share infrastructure with other duly authorised operators to support the deployment of components necessary for the development of high-speed and secure communications networks in Uganda. Operators must make available capacity on their infrastructure to other operators under fair, reasonable, and non-discriminatory conditions.

The Government of Uganda currently holds a stake in two telecommunications companies: Uganda Telecommunications Corporation Limited (UTCL) and MTN Uganda.
Regarding UTCL, the company traces its roots to the former Uganda Telecom Ltd (UTL), which was partially privatised in the 1990s. The Government of Uganda retained a minority shareholding until 2017, when the private shareholders unilaterally withdrew from the financially distressed firm, leaving the state as the sole owner. In April 2021, the government incorporated UTCL as a fully state-owned enterprise. By November 2022, UTCL had acquired all of UTL’s assets, and UTL ceased to exist. In December 2023, the government signed an agreement with Rowad Capital Commercial (RCC), a UAE-based firm, granting RCC a 60% stake in UTCL while retaining 40% ownership, 25% held by the Ministry of Finance and 15% by the Ministry of ICT. However, the acquisition has not yet been finalised, and implementation remains pending.
Regarding MTN Uganda, the National Social Security Fund (NSSF), a government-mandated retirement fund, became a major investor following the company’s initial public offering in December 2021. NSSF acquired an 8.84% stake, becoming the largest local institutional investor. In May 2024, NSSF increased its shareholding through a secondary offering, raising its total stake to 11.7%.

It is reported that Uganda does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there is an obligation of accounting separation. Under Section 14 of the 2019 Regulations, the Uganda Communications Commission (UCC) can require telecommunications operators to prepare and submit separate accounts for each of their activities. These accounts must be structured as if each activity were conducted by a legally independent entity.

Art. 38 of the Uganda Communications Act of 2013 states that, before granting a licence, the Commission shall take into account several criteria, including whether the grant of the licence is in the public interest. Section 93(3)(e) of the Uganda Communications (Licensing) Regulations further stipulates that, in assessing the merits of an application for a telecommunications licence, the regulator may take into account the benefits the applicant is likely to contribute to the industry, the users, and the Ugandan economy as a whole. These benefits may include investment, improvements in communications infrastructure, and advancements in capacity, capability, and connectivity.
Moreover, it has been reported that the implementation of the revised telecommunications licensing framework by the Uganda Communications Commission (UCC) has led to challenges for telecom operators. The 2019 framework requires applicants to pay separate fees for operating in different regions, in addition to the mandatory application fees and a 2% levy on gross annual earnings. Some have criticized the updated fees, arguing that they add to the already significant burden of existing levies and taxes on the sector.

Under Section 9 of the Uganda Communications (Licensing) Regulations No. 95 of 2019, the Uganda Communications Commission (UCC) may, when considering an application for a national telecommunications operator's licence, require the applicant to offer a prescribed percentage of its shares to the public, as determined by the Commission. The licence description for the National Telecom Operator (NTO) stipulates that the licensee must list a minimum of 20% of its shares on the Uganda Securities Exchange (USE) within two years of the licence’s issuance. This requirement is reportedly intended to promote local ownership of telecommunications services. In December 2021, MTN Uganda—the country’s largest telecommunications provider—listed 13% of its shares on the USE. Similarly, in December 2023, Airtel Uganda, the second-largest telecommunications company, listed 11% of its shares, excluding its mobile money subsidiary, on the USE.
In addition, Section 9 of the Licensing Regulations 2019 authorises the Commission to issue guidelines defining the scope of a licence, including the requirement for nationwide coverage. The NTO licence description specifies that this category of licence shall be granted to an operator that demonstrates both the financial and technical capacity to establish and operate a telecommunications network covering the entire geographical territory of Uganda. In March 2021, the UCC granted Lycamobile an NTO licence, making it the third operator to receive such authorisation, following MTN Uganda and Airtel Uganda. Under the terms of the NTO licence, Lycamobile is mandated to expand its network coverage to at least 90% of Uganda’s territory within five years.

Uganda has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

According to Arts. 15 and 16 of the Investment Code Act of 2019, investors must meet the minimum capital investment requirements as a precondition for investment registration. Although the Act does not specify a fixed threshold, it is reported that Uganda applies a minimum capital requirement of USD 250,000 for foreign investors seeking investment registration.