The Regulation of Interception of Communications Act of 2010 introduces obligations to intermediaries to install surveillance equipment, assist “the monitoring centre”, and ensure that their services can render real-time interception. Failure to assist the monitoring centre is an offence that, upon conviction, may result in a fine, imprisonment for up to five years, or cancellation of the intermediary license.

Section 19 of the Data Protection and Privacy Act stipulates that in the event that a data processor or data controller based in Uganda processes or stores personal data outside Uganda, the data processor or data controller must ensure that the country in which the data is processed or stored has in place adequate measures for the protection of personal data at least equivalent to the protection provided for by this Act, or that the data subject has consented. In addition, Regulation 30 of the Data Protection and Privacy Regulations provides further details, including that any personal data processed outside Uganda shall not be further transferred to or processed in a third country without the express consent of the data subject.

Uganda has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Data Protection and Privacy Act provides a comprehensive regime of data protection in Uganda. It, in particular, provides for a data protection and privacy register and processes for the investigation of complaints relating to the infringement of data subject rights under the Act. In addition, the Act establishes consent as a central principle, specifies conditions for consent relating to minors as well as other special categories, and, notably, has extraterritorial scope and may apply to entities outside Uganda.

Art. 6 of the Data Protection and Privacy Act mandates that institutions must appoint a Data Protection Officer (DPO). While the Act does not provide further details on the appointment, these are clarified in the Data Protection and Privacy Regulations, 2021. Specifically, the Regulations state that any individual, institution, or public body involved in processing or controlling personal data must designate a DPO if (Section 47.2):
- the activities of the person, institution or public body, consist of processing operations which by virtue of their nature, scope or purpose require regular and systematic monitoring of data subjects on a large scale; or
- consist of processing of special personal data in accordance with the Data Protection and Privacy Act.
Furthermore, according to Section 12 of the Regulations, where the collection or processing of personal data poses a high risk to the rights and freedoms of natural persons, the data collector, data processor, or data controller shall, prior to the processing and/or collection, carry out an assessment of the impact of the envisaged collection or processing operations on the protection of personal data.

Section 7 of the Data Protection and Privacy Act provides that, where necessary for the proper performance of a public duty by a public body, cases of national security or for the prevention, detection, investigation, prosecution, or punishment of an offence or breach of law, or for medical purposes, the public authority may collect data even at the objection of the data subject. It is not clarified whether a court order is needed. It is reported that the flexibility provided by the Act is not abused by the authorities, which limited its use to contain health emergencies.

The Regulation of Interception of Communications Act of 2010 introduces obligations to intermediaries to collect customer information (names, addresses, ID numbers), install surveillance equipment, and disclose information to authorities when presented with a warrant. However, it has been reported that state security agents violated these provisions in 2018 when they broke into the data centre of a telecommunications provider without a court order. It is also reported that the threshold for issuance of a warrant to be established is very low given that law enforcement must only demonstrate “reasonable” ground for unspecified and broad threats to national security, national economic interests and public safety.

The Electronic Transactions Act No. 8 of 2011 establishes a safe harbour regime for intermediaries for copyright infringements. According to Section 29 of Act No. 8 of 2011, a service provider is not subject to civil or criminal liability with respect to third-party material, which is in the form of electronic records to which it merely provides access. This is provided that the intermediary is not directly involved in the making, publication, dissemination, or distribution of the material or a statement made in the material or the infringement of any rights subsisting in or in relation to the material. In addition, pursuant to Art. 30 of the Act, service providers are not liable for infringement for referring or linking to a “data message or infringing activity” if the service provider is unaware of the infringement, does not receive financial benefit from the infringement, and “removes or disables access to the reference or link to the data message or activity within a reasonable time after being informed that the data message or the activity relating to the data message infringes the rights of the user.”

According to Section 9 of the Uganda Communications Commission Guidelines on Communications Infrastructure Deployment and Sharing, all licensed operators are required to coordinate and/or share infrastructure with other duly authorised operators to support the deployment of components necessary for the development of high-speed and secure communications networks in Uganda. Operators must make available capacity on their infrastructure to other operators under fair, reasonable, and non-discriminatory conditions.

The Government of Uganda currently holds a stake in two telecommunications companies: Uganda Telecommunications Corporation Limited (UTCL) and MTN Uganda.
Regarding UTCL, the company traces its roots to the former Uganda Telecom Ltd (UTL), which was partially privatised in the 1990s. The Government of Uganda retained a minority shareholding until 2017, when the private shareholders unilaterally withdrew from the financially distressed firm, leaving the state as the sole owner. In April 2021, the government incorporated UTCL as a fully state-owned enterprise. By November 2022, UTCL had acquired all of UTL’s assets, and UTL ceased to exist. In December 2023, the government signed an agreement with Rowad Capital Commercial (RCC), a UAE-based firm, granting RCC a 60% stake in UTCL while retaining 40% ownership, 25% held by the Ministry of Finance and 15% by the Ministry of ICT. However, the acquisition has not yet been finalised, and implementation remains pending.
Regarding MTN Uganda, the National Social Security Fund (NSSF), a government-mandated retirement fund, became a major investor following the company’s initial public offering in December 2021. NSSF acquired an 8.84% stake, becoming the largest local institutional investor. In May 2024, NSSF increased its shareholding through a secondary offering, raising its total stake to 11.7%.

It is reported that Uganda does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there is an obligation of accounting separation. Under Section 14 of the 2019 Regulations, the Uganda Communications Commission (UCC) can require telecommunications operators to prepare and submit separate accounts for each of their activities. These accounts must be structured as if each activity were conducted by a legally independent entity.

Art. 38 of the Uganda Communications Act of 2013 states that, before granting a licence, the Commission shall take into account several criteria, including whether the grant of the licence is in the public interest. Section 93(3)(e) of the Uganda Communications (Licensing) Regulations further stipulates that, in assessing the merits of an application for a telecommunications licence, the regulator may take into account the benefits the applicant is likely to contribute to the industry, the users, and the Ugandan economy as a whole. These benefits may include investment, improvements in communications infrastructure, and advancements in capacity, capability, and connectivity.
Moreover, it has been reported that the implementation of the revised telecommunications licensing framework by the Uganda Communications Commission (UCC) has led to challenges for telecom operators. The 2019 framework requires applicants to pay separate fees for operating in different regions, in addition to the mandatory application fees and a 2% levy on gross annual earnings. Some have criticized the updated fees, arguing that they add to the already significant burden of existing levies and taxes on the sector.

Under Section 9 of the Uganda Communications (Licensing) Regulations No. 95 of 2019, the Uganda Communications Commission (UCC) may, when considering an application for a national telecommunications operator's licence, require the applicant to offer a prescribed percentage of its shares to the public, as determined by the Commission. The licence description for the National Telecom Operator (NTO) stipulates that the licensee must list a minimum of 20% of its shares on the Uganda Securities Exchange (USE) within two years of the licence’s issuance. This requirement is reportedly intended to promote local ownership of telecommunications services. In December 2021, MTN Uganda—the country’s largest telecommunications provider—listed 13% of its shares on the USE. Similarly, in December 2023, Airtel Uganda, the second-largest telecommunications company, listed 11% of its shares, excluding its mobile money subsidiary, on the USE.
In addition, Section 9 of the Licensing Regulations 2019 authorises the Commission to issue guidelines defining the scope of a licence, including the requirement for nationwide coverage. The NTO licence description specifies that this category of licence shall be granted to an operator that demonstrates both the financial and technical capacity to establish and operate a telecommunications network covering the entire geographical territory of Uganda. In March 2021, the UCC granted Lycamobile an NTO licence, making it the third operator to receive such authorisation, following MTN Uganda and Airtel Uganda. Under the terms of the NTO licence, Lycamobile is mandated to expand its network coverage to at least 90% of Uganda’s territory within five years.

Uganda has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

The country’s telecommunications authority is the Uganda Communications Commission (UCC). However, it has been reported that the entity’s decision‑making process is not fully independent from the government. Although Art. 8 of the Uganda Communications Act, 2013 mandates the UCC to exercise its functions independently and without influence from any person or authority, concerns have been raised regarding the lack of effective independence, particularly in relation to Art. 7, which requires the UCC to comply with policy guidelines issued by the Minister of Information when performing its functions.