Uganda

Section 23(1) requires a data collector, processor or controller that believes personal data has been accessed or acquired by an unauthorised person to notify the Authority (NITA-U) immediately and in the prescribed manner. Under s. 23(2) the Authority decides whether the data subject must also be told.

Section 9(1) bars employers and others from victimising a person for a protected disclosure, and s. 9(2) lists dismissal, suspension, demotion and harassment as forms of victimisation. Disclosures may be made internally (s. 4) or externally to bodies listed in s. 4(3), including the Inspectorate of Government; victimising a whistleblower is an offence (s. 16).