How to Report a Data Breach in Uganda Online (PDPO Form 7, Timelines & Penalties)

Last updated: 24 May 2026

Understanding how to report a data breach in Uganda online is now a frontline compliance obligation for every organisation that collects, stores or processes personal data within the country. The Personal Data Protection Office (PDPO Uganda) operates a dedicated data protection office portal where controllers submit Form 7, Notification of Data Breach, and the regulator’s enforcement posture has sharpened considerably since its landmark 2025 findings against multinational technology companies.

This guide walks data protection officers, in-house counsel and IT security managers through every stage of the breach notification process: who must act, what Form 7 requires field by field, the statutory timelines under the Data Protection and Privacy Act Uganda (the DPPA), available escalation channels, and the penalties that follow non-compliance.

Quick Answer: How Can I Report a Data Breach in Uganda?

Yes, you report a data breach in Uganda online through the PDPO portal at pdpo. go. ug, using the “File Complaint / Report a Breach” function and completing Form 7 (Notification of Data Breach). The data controller bears primary responsibility for the notification. Processors must inform the controller without undue delay so that the controller can submit Form 7 to the PDPO. Where the breach is likely to result in high risk to the rights and freedoms of affected individuals, the controller must also notify those data subjects directly. Internally, your organisation should contain the incident immediately, within hours, and then file the PDPO notification as soon as practicable.

Failure to report can trigger administrative penalties, compliance orders and reputational damage under the DPPA.

Why Report: Data Breach Notification Requirements Uganda, Legal Basis and Regulator

Legal Basis: The Data Protection and Privacy Act 2019

Uganda’s data breach notification requirements are anchored in the Data Protection and Privacy Act, 2019 (the DPPA). The Act places mandatory obligations on data controllers and processors to safeguard personal data and to report breaches that compromise its confidentiality, integrity or availability. The DPPA applies to all organisations, whether incorporated in Uganda or processing the data of persons located in Uganda, and covers both the public and private sectors. Its provisions establish the legal framework within which breach notification in Uganda operates.

Who Enforces It: PDPO Uganda, NITA-U and UCC

The Personal Data Protection Office (PDPO), established under the DPPA, is the primary supervisory authority. Housed within the National Information Technology Authority, Uganda (NITA-U), the PDPO receives breach reports, investigates complaints, issues compliance orders and imposes penalties. NITA-U itself provides the broader ICT governance framework and operates complementary data-protection obligations for government bodies. The Uganda Communications Commission (UCC) handles cybercrime and telecommunications-related offences, making it a parallel reporting channel where criminal activity, such as ransomware or hacking, is involved. Organisations should understand which regulator to approach first: for data privacy breaches, the PDPO; for cybercrime, UCC and law enforcement.

Decision Flow: Controller vs Processor, Who Must Act on Breach Notification in Uganda

A critical early step after discovering a breach is determining who holds the notification obligation. The DPPA draws a clear line between the data controller (the entity that determines the purposes and means of processing) and the data processor (the entity that processes data on the controller’s behalf). The table below sets out the primary duties and practical actions each party must take.

When Processors Must Notify Controllers

A processor that becomes aware of a personal data breach must alert its controller without undue delay. The notification should include the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures the processor has already taken to contain the incident. In practice, data-processing agreements should set a tighter contractual window, commonly 24 to 48 hours, to give the controller sufficient time to assess the breach and file Form 7 with the PDPO. Processors that delay or suppress breach information face potential contractual liability and regulatory scrutiny.

Controller Duties on Receipt of Processor Notification

Once a controller receives a breach notice from its processor, it must independently evaluate the severity, scope and risk to data subjects. If the breach is likely to result in risk to individuals’ rights and freedoms, the controller must file Form 7 with the PDPO and consider whether direct notification to affected data subjects is also required. The controller should document every decision, including any decision not to notify, in its internal breach register. This record becomes vital if the PDPO later investigates or audits the organisation’s compliance posture.

How to Report a Data Breach Online: PDPO Portal and Form 7 Notification of Data Breach, Step by Step

The data protection office portal at pdpo.go.ug is the single official channel for submitting a Form 7 notification of data breach to the regulator. Below is a detailed, step-by-step walkthrough designed for compliance officers filing for the first time.

Pre-Submission Checklist

Before accessing the portal, assemble the following evidence and information:

• Incident summary. A concise description of what happened, when it was discovered, and how it was detected.
• Categories of personal data affected. For example: names, national ID numbers, financial records, health data, biometric data.
• Categories of data subjects. Employees, customers, minors, patients, etc.
• Estimated number of data subjects affected. Provide a range if the exact figure is not yet confirmed.
• Containment actions taken. System isolation, password resets, access revocation, patches deployed.
• Impacted systems and data stores. Server names, databases, cloud environments, third-party platforms.
• Log extracts and forensic findings. Relevant access logs, intrusion-detection alerts, forensic images (if available at time of filing).
• Designated contact person. Name, title, email and telephone number of the person the PDPO should contact for follow-up.

Step 1, Access the PDPO Portal

Navigate to pdpo.go.ug and locate the “File Complaint” or “Report a Breach” link, typically displayed on the homepage navigation bar. Registered organisations can log in with their existing PDPO credentials; first-time users may need to create an account or submit as a guest, depending on current portal settings. Industry observers note that the PDPO has progressively streamlined the portal interface since its initial launch, which was covered by UNCDF when the platform first went live.

Step 2, Select “Report a Breach” and Choose Form 7

Once inside the portal, select the breach-reporting function (as distinct from general complaints about data misuse). The system will present Form 7, Notification of Data Breach. This is the prescribed form under the DPPA for controllers to formally report a breach to the PDPO. Confirm the entity name, registration number (if applicable) and proceed to the form fields.

Step 3, Complete Form 7 Field by Field

Form 7 typically requires the following information. Provide clear, factual answers, avoid speculation or minimisation:

• Date and time of the breach. State the exact or best-estimated date and time the breach occurred, and separately the date and time it was discovered.
• Nature of the breach. Describe whether this involved unauthorised access, accidental disclosure, loss of data, ransomware encryption, insider misuse, or another category.
• Categories of personal data compromised. List every data type involved (e.g., “full names, national identification numbers, mobile phone numbers, financial account details”).
• Categories and approximate number of data subjects. For example: “approximately 12,000 retail banking customers.”
• Description of likely consequences. Explain the potential impact, identity theft, financial loss, reputational harm, physical safety risk, discrimination.
• Technical and organisational measures in place at the time. Describe encryption standards, access controls, monitoring systems and any relevant certifications.
• Mitigation measures taken or proposed. Detail containment steps already executed and the remediation plan going forward.
• Whether data subjects have been notified. State yes or no, and if yes, the method, date and content of the notification.
• Contact details of the data protection officer or designated contact. Full name, title, direct email and phone number.

Step 4, Attachments and Evidence

Upload supporting documents: the incident report, relevant log extracts, forensic analysis summaries and copies of any communications sent to affected individuals. Redact any data that is not necessary for the PDPO’s assessment, for example, mask full national ID numbers in sample records. Use PDF or standard file formats accepted by the portal.

Step 5, Submit and Record Confirmation

Review all entries, then submit. The portal should generate a confirmation reference number. Save this immediately, take a screenshot and store the reference in your breach register. This reference will be needed for all follow-up correspondence with the PDPO. Retain a complete copy of the submitted Form 7 and all attachments in your organisation’s records.

Example Form 7 Responses

Below is sample language for selected fields to illustrate the level of detail the PDPO expects:

• Nature of breach: “On 14 March 2026, an unauthorised third party exploited a vulnerability in our customer portal (SQL injection), gaining read access to a database containing personal data of retail customers.”
• Categories of data compromised: “Full names, email addresses, mobile phone numbers and encrypted (hashed) passwords.”
• Likely consequences: “Affected individuals face a moderate risk of phishing attacks and potential account takeover if they re-used the same credentials on other platforms.”
• Mitigation measures: “The vulnerability was patched within four hours of discovery. All affected user passwords were force-reset. We engaged a third-party forensic firm and deployed enhanced web-application firewall rules. Affected customers were notified by email on 15 March 2026 with guidance on securing their accounts.”

Data Breach Notification Uganda Timelines, Escalation and Parallel Reporting Channels

The DPPA requires controllers to notify the PDPO of a qualifying breach without undue delay. While the Act does not prescribe a rigid hour count in the way that the EU’s GDPR specifies 72 hours, the practical expectation, informed by PDPO guidance and comparative regional standards, is that organisations should aim to submit Form 7 within 48 to 72 hours of becoming aware of a breach that is likely to pose risk. The phrase “without undue delay” means that unjustified postponement will itself be treated as a compliance failure.

When to Notify Affected Individuals

Individual notification is required when the breach is likely to result in a high risk to the rights and freedoms of data subjects, for example, where identity documents, financial data or health records have been exposed. The notification should be in plain language and must include: a description of the breach, the types of data involved, the likely consequences, the measures taken, and clear contact details for the organisation’s data protection officer. Early indications suggest the PDPO favours proactive individual notification as a mitigating factor during enforcement reviews.

When to Report to Other Agencies: UCC, Police, NITA-U

If the breach involves criminal conduct, hacking, ransomware, fraud or sabotage, the organisation should report simultaneously to the Uganda Police Force (CID, Electronic Crimes Unit) and the Uganda Communications Commission (UCC). The UCC maintains guidance on cybercrime reporting through its fraud and complaints channels. Reporting to law enforcement does not replace the obligation to file Form 7 with the PDPO; both tracks should proceed in parallel. For breaches within government agencies, NITA-U may additionally coordinate the response under its mandate for public-sector ICT governance. Organisations operating in regulated sectors, such as banking or telecommunications, may also have sector-specific reporting obligations to the relevant industry regulator.

Penalties, Enforcement Trends and Illustration of Recent Cases

The DPPA provides the PDPO with a range of enforcement powers. These include issuing compliance notices, ordering cessation of data-processing activities, imposing administrative fines and, in serious cases, recommending criminal prosecution. Organisations that fail to report a breach, obstruct an investigation or repeatedly violate data protection obligations face the heaviest sanctions.

The PDPO’s enforcement posture has intensified. On 18 July 2025, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) reported that the PDPO issued findings against Google for breaching Uganda’s data protection law, including a failure to register locally, and ordered the company to comply with registration and other DPPA requirements. This decision signalled that even global technology companies are not beyond the PDPO’s reach and that registration and breach-reporting compliance are being actively monitored.

Separately, the civil society organisation Unwanted Witness published an investigation report into a data security breach at the Uganda Securities Exchange (USE), detailing how personal and financial data of investors was exposed. The investigation highlighted weaknesses in incident-response preparedness and the importance of timely regulator notification. Industry observers expect these cases to set the tone for stricter enforcement through 2026 and beyond.

Practical Risk Mitigation

• Self-report promptly. Voluntary, early reporting is consistently viewed more favourably by the PDPO than delayed disclosure uncovered during an investigation.
• Maintain remediation logs. Detailed records of containment steps, forensic findings and communications demonstrate good faith.
• Prepare public notice templates. Having pre-drafted data subject notification templates, reviewed by legal counsel, accelerates your response and reduces errors under pressure.
• Conduct regular tabletop exercises. Simulated breach drills ensure your team can execute the Form 7 process under real-time conditions.

Evidence Checklist and Post-Submission Obligations

After filing Form 7 with the PDPO, your obligations continue. Use the checklist below to ensure your post-submission compliance is complete:

• Form 7 confirmation reference. Stored securely with timestamp and screenshot.
• Complete copy of the submitted Form 7. Including all field entries and attachments.
• Incident report. Internal document summarising the breach timeline, root cause and impact assessment.
• System and access logs. Covering the period before, during and after the breach.
• Forensic report summary. If a third-party forensic investigation was conducted, retain the final report.
• Communications to data subjects. Copies of all notification emails, letters or SMS messages sent.
• Remediation plan. A documented action plan addressing the root cause, with assigned owners and deadlines.
• Correspondence with the PDPO. All follow-up queries from the regulator and your responses.

Recordkeeping Requirements

The DPPA requires controllers to maintain a register of all data breaches, regardless of whether a PDPO notification was triggered. Each entry should record the facts of the breach, its effects and the remedial action taken. The likely practical effect of this requirement is that organisations should retain breach records for a minimum period aligned with general regulatory limitation periods, typically five to seven years, unless the PDPO specifies otherwise. This register may be requested during PDPO audits or follow-up investigations and serves as evidence of an organisation’s overall compliance culture in Uganda.

Practical Templates and Sample Wording

Template A: Form 7 Sample, Medium-Sized Controller Breach

Organisation: [Company Name] | PDPO Registration No.: [If applicable]
Date of breach: 14 March 2026 | Date discovered: 14 March 2026
Nature: Unauthorised access to customer database via SQL injection
Data compromised: Full names, email addresses, phone numbers (approx. 12,000 customers)
Likely consequences: Moderate risk of phishing; low risk of financial loss (no payment data exposed)
Mitigation: Vulnerability patched; passwords force-reset; forensic firm engaged; enhanced WAF rules deployed
Individual notification: Sent by email on 15 March 2026
Contact: [DPO Name], [Email], [Phone]

Template B: Data Subject Notification

Dear [Name],

We are writing to inform you of a data security incident that may have affected your personal information. On [date], we identified unauthorised access to a system that contained your [types of data]. We have taken immediate steps to contain the incident, including [brief mitigation summary]. Based on our assessment, the main risk to you is [describe risk, e.g., potential phishing emails]. We recommend that you [change your password / monitor your accounts / remain alert to suspicious communications]. If you have questions, please contact our Data Protection Officer at [email] or [phone]. We have also reported this incident to the Personal Data Protection Office (PDPO).

Where to Get Legal Help and Next Steps

Data breach response in Uganda demands swift coordination between legal, technical and compliance teams. If your organisation has experienced a breach, or wants to build a robust incident-response framework before one occurs, specialist legal guidance is essential. The Uganda lawyer directory on Global Law Experts connects organisations with TMT and data protection practitioners who advise on PDPO filings, cross-border transfer risks and regulatory investigations. Whether you need immediate incident-response support, assistance completing Form 7, or a comprehensive review of your data protection compliance programme, engaging experienced Ugandan counsel early is the most effective way to protect your organisation. Browse the Uganda legal directory to find a qualified practitioner.

Sources

1. Personal Data Protection Office (PDPO), File Complaint / Report a Breach
2. PDPO, Homepage
3. National Information Technology Authority – Uganda (NITA-U), Data Protection Privacy Notice
4. UNCDF, Uganda Launches Data Protection & Privacy Portal
5. DLA Piper, Data Protection Laws of the World: Uganda
6. Unwanted Witness, Investigation Report: Uganda Securities Exchange Data Breach
7. CIPESA, Ugandan Regulator Finds Google in Breach of Data Protection Law (18 July 2025)
8. Uganda Communications Commission (UCC), Fraud FAQs and Cybercrime Reporting