It is reported that the Central Bank of Uganda interprets the country's cybersecurity legislation as giving it the power to require financial institutions to relocate their data centres to Uganda in order to provide the government with access to customers' digital financial information. It is also reported that regulated financial institutions are currently implementing this policy.

Section 19 of the Data Protection and Privacy Act stipulates that in the event that a data processor or data controller based in Uganda processes or stores personal data outside Uganda, the data processor or data controller must ensure that the country in which the data is processed or stored has in place adequate measures for the protection of personal data at least equivalent to the protection provided for by this Act, or that the data subject has consented. In addition, Regulation 30 of the Data Protection and Privacy Regulations provides further details, including that any personal data processed outside Uganda shall not be further transferred to or processed in a third country without the express consent of the data subject.

Uganda has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Data Protection and Privacy Act provides a comprehensive regime of data protection in Uganda. It, in particular, provides for a data protection and privacy register and processes for the investigation of complaints relating to the infringement of data subject rights under the Act. In addition, the Act establishes consent as a central principle, specifies conditions for consent relating to minors as well as other special categories, and, notably, has extraterritorial scope and may apply to entities outside Uganda.

Uganda has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.

Uganda has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Uganda is not a signatory of the 1996 World Trade Organization (WTO) Information Technology Agreement (ITA) nor the 2015 expansion (ITA II).

Section 50.2 of the Public Procurement and Disposal of Public Assets Act provides that to promote particular sectors within specified geographic areas, specified public procurement contracts or parts of an agreement are subject to reservation schemes. The Authority must, in consultation with a competent authority and the relevant stakeholders, specify the public procurement contracts to be subject to a reservation scheme and designate the particular sectors within a specified geographical area that are eligible to participate in the reservation scheme (Section 59B).

Section 50 of the Public Procurement and Disposal of Public Assets Act provides that, subject to the economic and social policies of the Government and the international obligations of the Government, preference is given to domestically manufactured goods and Ugandan contractors and Ugandan consultants in order to promote their development, by giving them a competitive advantage when competing for public procurement contracts, with foreign manufactured goods, foreign contractors or foreign consultants. Moreover, Section 59A(3) states that in the procurement of goods, works, or services through open tendering, a margin of preference of up to 15% for goods and up to 7% for works or services applies.

Uganda is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

Section 19.2 of the Investment Code Act gives the minister powers to restrict participation by foreigners in certain investments in Uganda. Even though this is not specific to digital services, this provision opens up possibilities for restrictions in this sector.

Section 19.2 of the Investment Code Act gives the minister powers to restrict participation by foreigners in certain investments in Uganda. Even though this is not specific to digital services, this provision opens up possibilities for restrictions in this sector. Information technology is included among the 26 listed priority areas.

According to the Investment Code Act of 2019, it is mandatory for foreign entities who intend to invest in the priority areas under Schedule 2 of the Act in Uganda to register with the Authority, and failure to do so is punishable by a fine of UGX 20-million (approximately USD 5,400) or a term of imprisonment of four years, or both.
An investor is required to apply to the authority to get an investment certificate/investment license. An investor must satisfy the minimum investment capital for domestic investments of USD 50,0000 (approx. UGX 185,000,000) or foreign investment of USD 100,000 (approx. UGX 370,000,000) to qualify for registration and issuance of an investment license.
Section 17 provides for the requirements for the application of an investment licence, including local content requirements, which every investor must meet before an investment certificate can be issued. These are:
- A certificate of registration of the business;
- Business plan which must include the name of the investment and detailed information on the type of investment; the action plan; the date of commencement of operations; detailed information on raw materials sourced in the country or in the locality where the investment is to operate; detailed information on any financing and assets to be sourced from outside Uganda, including the timeframe in which these finances and assets shall be invested; land requirement for the investment; the location of the investment; utilities required for the investment; a market survey; details of the projected technology and knowledge transfer;
- An environmental impact assessment certificate issued in accordance with the relevant laws;
- The projected number of employees; and
- A license granted by the business sector in which the investor intends to operate.

Section 7 of the NITA-U (Certification of IT Providers and Services) Regulations No. 69 of 2016 stipulates that applicants seeking certification for the provision of IT services must be registered as a company in Uganda and obtain separate certification for conducting online business or providing IT services. In addition, as outlined in Art. 6 of the Regulations, applicants must comply with established standards for technology provision, demonstrate financial viability, have competent management, implement policies and procedures for service provision, employ qualified staff, and maintain appropriate infrastructure and equipment.