Uganda has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Data Protection and Privacy Act provides a comprehensive regime of data protection in Uganda. It, in particular, provides for a data protection and privacy register and processes for the investigation of complaints relating to the infringement of data subject rights under the Act. In addition, the Act establishes consent as a central principle, specifies conditions for consent relating to minors as well as other special categories, and, notably, has extraterritorial scope and may apply to entities outside Uganda.

Section 7 of the Data Protection and Privacy Act provides that, where necessary for the proper performance of a public duty by a public body, cases of national security or for the prevention, detection, investigation, prosecution, or punishment of an offence or breach of law, or for medical purposes, the public authority may collect data even at the objection of the data subject. It is not clarified whether a court order is needed.

The Regulation of Interception of Communications Act of 2010 introduces obligations to intermediaries to collect customer information (names, addresses, ID numbers), install surveillance equipment, and disclose information to authorities when presented with a warrant. It is, however, reported that state security agents violated such provisions in 2018 when security agents stormed a telecom provider’s data centre without a court warrant.
In addition, intermediaries are obliged to assist “the monitoring centre” and ensure that their services can render real-time interception. Failure to assist the monitoring centre is an offence that, upon conviction, may result in a fine, imprisonment for up to five years, or cancellation of the intermediary license. In addition, an application for interception can be made orally before a judge as long as the written application follows within 48 hours of the oral application.

Under Section 11 of Act No. 2, trade secrets may be required to be submitted to a government department, but the department must protect the information submitted to it from disclosure.

The Trade Secrets Protection Act No. 2 of 2009 provides a framework for effective protection of trade secrets.

It is reported that there is an obligation for passive infrastructure sharing in Uganda to deliver telecom services to end users. It is practised in both the mobile and fixed sectors based on commercial agreements.

Following the privatisation of Uganda Telecom Ltd (UTL) in the 1990s, the Government held minority shares in the company up until 2017, when the rest of the shareholders unilaterally pulled out from the financially struggling company, leaving the state as a sole owner.

It is reported that Uganda does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there is an obligation of accounting separation.

Section 93(3)(e) of the Uganda Communications (Licensing) Regulations stipulates that, in assessing the merits of an application for a telecommunications licence, the regulator may take into account the benefits the applicant is likely to contribute to the industry, the users, and the Ugandan economy as a whole. These benefits may include investment, improvements in communications infrastructure, and advancements in capacity, capability, and connectivity. Moreover, it has been reported that the implementation of the revised telecommunications licensing framework by the Uganda Communications Commission (UCC) has led to challenges for telecom operators. The 2019 framework requires applicants to pay separate fees for operating in different regions, in addition to the mandatory application fees and a 2% levy on gross annual earnings. Some have criticized the updated fees, arguing that they add to the already significant burden of existing levies and taxes on the sector.

Under Section 9 of the Uganda Communications (Licensing) Regulations No. 95 of 2019, the Uganda Communications Commission (UCC) may, when considering an application for a national telecommunications operator's licence, require the applicant to offer a prescribed percentage of its shares to the public, as determined by the Commission. The licence description for the National Telecom Operator (NTO) stipulates that the licensee must list a minimum of 20% of its shares on the Uganda Securities Exchange (USE) within two years of the licence’s issuance. This requirement is reportedly intended to promote local ownership of telecommunications services. In December 2021, MTN Uganda—the country’s largest telecommunications provider—listed 13% of its shares on the USE. Similarly, in December 2023, Airtel Uganda, the second-largest telecommunications company, listed 11% of its shares, excluding its mobile money subsidiary, on the USE.
In addition, Section 9 of the Licensing Regulations 2019 authorises the Commission to issue guidelines defining the scope of a licence, including the requirement for nationwide coverage. The NTO licence description specifies that this category of licence shall be granted to an operator that demonstrates both the financial and technical capacity to establish and operate a telecommunications network covering the entire geographical territory of Uganda. In March 2021, the UCC granted Lycamobile an NTO licence, making it the third operator to receive such authorisation, following MTN Uganda and Airtel Uganda. Under the terms of the NTO licence, Lycamobile is mandated to expand its network coverage to at least 90% of Uganda’s territory within five years.

Uganda has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that the Uganda Communications Commission (UCC), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

According to the Investment Code Act of 2019, it is mandatory for foreign entities who intend to invest in the priority areas under Schedule 2 of the Act in Uganda to register with the Authority, and failure to do so is punishable by a fine of UGX 20-million (approximately USD 5,400) or a term of imprisonment of four years, or both.
An investor is required to apply to the authority to get an investment certificate/investment license. An investor must satisfy the minimum investment capital for domestic investments of USD 50,0000 (approx. UGX 185,000,000) or foreign investment of USD 100,000 (approx. UGX 370,000,000) to qualify for registration and issuance of an investment license.
Section 17 provides for the requirements for the application of an investment licence, including local content requirements, which every investor must meet before an investment certificate can be issued. These are:
- A certificate of registration of the business;
- Business plan which must include the name of the investment and detailed information on the type of investment; the action plan; the date of commencement of operations; detailed information on raw materials sourced in the country or in the locality where the investment is to operate; detailed information on any financing and assets to be sourced from outside Uganda, including the timeframe in which these finances and assets shall be invested; land requirement for the investment; the location of the investment; utilities required for the investment; a market survey; details of the projected technology and knowledge transfer;
- An environmental impact assessment certificate issued in accordance with the relevant laws;
- The projected number of employees; and
- A license granted by the business sector in which the investor intends to operate.

In accordance with Art. 68 of the National Payment Systems Act, all electronic money issuers are obliged to establish and maintain their primary data centre in relation to payment system services in Uganda.