Uganda's PDPO finds Google in breach and asserts extraterritorial reach

On 18 July 2025, Uganda's PDPO found Google LLC in breach of the Data Protection and Privacy Act 2019 for failing to register and for transferring Ugandan users' data abroad without adequate safeguards, ordering registration within 30 days (Ssekamwa Frank & 3 Others v Google LLC).

The office rejected Google's no-physical-presence defence outright, holding that any entity collecting or processing Ugandan citizens' data falls within the Act's reach. The decision's practical limit is structural: the PDPO can make declaratory orders only and cannot impose fines, so complainants were referred to the courts for compensation.