A legal showdown is brewing in Uganda, raising critical questions about digital rights, data governance, and the accountability of tech giants operating in the country. Four Ugandan activists, Ssekamwa Frank, Leni Sharon Pamela, Amumpaire Raymond, and Awino Mercy, have jointly filed a judicial review case against the Personal Data Protection Office (PDPO), Google LLC, and Google Uganda. Their goal: to defend the integrity of Uganda’s data protection laws and ensure compliance by all players, local or foreign.
“Privacy is the cornerstone of many fundamental rights in the digital age. This case for transparency and accountability from data controllers and the government to ensure that technological progress never comes at the cost of human rights and freedoms,” said Ssekamwa Frank.
The case stems from Google’s alleged non-compliance with the Data Protection and Privacy Act (Cap 97), which requires all entities collecting or processing personal data in Uganda to register with the PDPO. The applicants argue that Google, despite its vast operations and user base in the country, has not registered as a data controller or processor, a move they claim violates the law and compromises the digital rights of millions of Ugandans.
In October 2024, the group wrote to Google, demanding compliance with Ugandan data regulations. When that letter went unanswered, they filed a formal complaint with the PDPO on November 8, 2024. An ex parte hearing held on November 21, 2024, without Google present, resulted in PDPO acknowledging Google’s non-registration and promising a prompt decision; however, no ruling was issued within the required 30 days.
For several months of silence and delay from the PDPO, the complainants reached out to the Attorney General and the Board Chairperson of the National Information Technology Authority (NITA-U) in April 2025, requesting immediate intervention. These efforts also received no reply, prompting the group to take legal action.
The case, Judicial Review Cause No. 22 of 2025, was filed on May 22. It outlines eight key legal requests, including a declaration that Google’s operations violate the rights of Ugandans, an order to halt data collection and processing by Google until it complies with registration requirements, and a directive compelling the PDPO to fulfill its statutory duties. They also seek transparency through the publication of a list of jurisdictions deemed to have equivalent data protection frameworks.
“As the High Court prepares to hear this case, Ugandans will be closely watching. It should refine our data governance and send a clear message to every data processor that Uganda’s data privacy laws are non-negotiable,” said Leni Sharon Pamela. Her colleague added, “We didn’t go to court for headlines or handshakes. We went to court because someone had to,” said Ssekamwa.
“Upon contacting NITA-Uganda regarding this matter, they directed us to the PDPO, now operating as an independent entity, as the appropriate authority. When subsequently contacted for comment, a PDPO stated: ‘This matter is currently under investigation. An update will be shared in due course, and all relevant stakeholders will be informed accordingly.”
Their case represents a pivotal moment in the push for data justice in Africa, a demand that even the most powerful tech companies must respect Ugandan laws and the rights of its people.
