Some stories are best told as evidence rather than opinion, and a new law is one of them. Uganda has enacted the Data Protection and Privacy Act, establishing rules for the collection, processing, storage and transfer of personal data. The event is precise, the primary documents exist, and the disciplined way to cover it is to build a source-led package: what can be verified from the record on this date, what the law provides, and what must be held back as a separate, later-dated follow-up. This is a chronology and an evidence pack, assembled to let the reader weigh the change without waiting for the narrative to settle.
The Primary Record: What the documents establish
The foundation is the statute itself. The text of the Data Protection and Privacy Act is the primary document, and it establishes the core verifiable facts: that Uganda now has rules governing how personal data is collected, processed, stored and transferred, that these attach duties to organisations holding data, and that they create rights for the individuals whose data is held. The named sectors most affected — banks, telecoms, health providers and digital platforms — follow directly from the law’s reach. Everything in the evidence pack should trace back to a document like this rather than to inference. Takeaway: the statute is the anchor source, and the verifiable claims begin and end with what it says.
The Timeline: Sequencing what is knowable now
A source-led package needs a chronology that respects the date. As of now, the verifiable timeline runs to the enactment and the duties it sets out; the machinery of implementation, guidance and enforcement lies ahead and belongs on the timeline only as an expectation, not an event. The discipline is to mark clearly what has happened versus what the law provides for. The oversight role of institutions such as NITA-U is on the record as a responsibility; how it plays out is a future entry. This matters for the reader who wants to act rather than wait: the difference between a duty that exists on the page and one that is enforced in practice is exactly the difference a business must plan around. A responsible package presents both the firm commitment and the open implementation question side by side, without collapsing one into the other. Takeaway: the chronology stops at the enactment, and everything downstream is labelled as pending, not done.
The Verification Boundary: What must wait
The hardest editorial discipline is refusing the follow-up. The effect of the law on prices, on adoption, on cross-border business behaviour, on enforcement — none of it is knowable today, and asserting it would be fabrication dressed as reporting. Those questions become separate, separately dated stories as evidence accumulates. Specific figures on compliance cost or market impact are not available on this date and are marked [TK] rather than estimated. The package’s integrity depends on drawing that line clearly. Takeaway: the boundary between the documented present and the unknown future is the story’s guarantee of accuracy.
So What: Build the evidence pack, then watch the indicators
For an operator or analyst, the decision implication is to treat this as the opening file, not the closing verdict. Assemble the primary text, log the verifiable claims, and set the indicators to track — adoption, pricing, enforcement actions, regional alignment — against Uganda’s place in an uneven East African patchwork of privacy regimes. A source-led approach lets a business act on what is known while staying honest about what is not. The Act is on the record. The evidence pack starts here; the follow-ups, properly dated, will write themselves as the facts arrive.
