Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Four Ugandan complainants sued Google LLC for failing to register with the PDPO and unlawfully transferring their data abroad, causing distress. The PDPO found Google in violation, ordering it to register and provide its cross-border data transfer compliance framework within 30 days. Compensation was outside PDPO's authority.

Facts

The Complainants lodged their complaint with the Personal Data Protection Office (PDPO) on 8th November 2024, alleging that Google LLC violated Uganda’s Data Protection and Privacy Act, Cap. 97, and its Regulations. Specifically, they asserted three main breaches:

• That Google LLC failed to register with PDPO as a data collector, controller, or processor, as required by law.
• That Google unlawfully transferred their personal data outside Uganda without meeting the legal conditions enshrined in the Data Protection and Privacy Act, Cap 97, and its Regulations.
• They claimed these actions infringed their data protection and privacy rights and caused them distress, for which they sought remedies and compensation. They also stated that attempts to communicate with Google LLC by email went unanswered, leaving them without recourse or reassurance regarding their data.

<aside> 🎙️

Listen to the case on Audio Notes | Episode 12 | Global Reach, Local Rules: Uganda Takes on Google's Data Practice

</aside>

Google LLC was directed by the PDPO to file a written response by 12th March 2025. After a delay and a requested extension, Google LLC filed its response on 10th July 2025. In its response, Google LLC:

• Acknowledged processing personal data of Ugandan users but argued that its various corporate entities are separate.
• Maintained that no registration obligation currently arises absent a Gazette notice under Regulation 15(2), which allows PDPO to exempt certain categories from registration and which PDPO had not issued.
• Asserted that its global Privacy Policy adequately safeguards personal data and meets accountability requirements under Ugandan law.
• Contended that Section 19 of the Act and Regulation 30, which govern cross-border data transfers, apply only to controllers or processors domiciled in Uganda, and that Google LLC has no such domicile or physical presence in Uganda, thus arguing these provisions were not applicable to them.
• Sought dismissal of the complaint as devoid of merit.