Uganda's PDPO finds Google in breach and asserts extraterritorial reach

On 18 July 2025, Uganda's PDPO found Google LLC in breach of the Data Protection and Privacy Act 2019 for failing to register and for transferring Ugandan users' data abroad without adequate safeguards, ordering registration within 30 days (Ssekamwa Frank & 3 Others v Google LLC). The office rejected Google's no-physical-presence defence outright: any entity that collects or processes Ugandan citizens' data is within the Act's reach. The decision's limit is structural, since the PDPO can make declaratory orders only and cannot fine; complainants were referred to the courts for compensation.