Every day Ugandans surrender personal information they never priced. A SIM card demands a national ID and a photograph. A mobile-money wallet logs each transfer. A digital lender reads a phone’s contact list before advancing a few thousand shillings. Until now, no single statute told the firms holding that information what they owed the person behind it. That gap has just closed. Uganda has enacted the Data Protection and Privacy Act, and for the consumer market the change is less about privacy as a principle than about who controls the most valuable asset in the digital economy: the customer relationship.

The Rulebook: From informal collection to stated duties

The Act sets rules for how personal data is collected, processed, stored and transferred, and it attaches duties to the organisations that do the collecting. For the ordinary user in Kampala or Entebbe, the practical promise is that consent, purpose and accuracy now have legal weight rather than resting on a firm’s goodwill. Banks, telecoms, health providers and digital-platform operators — the four sectors that sit on the deepest pools of Ugandan personal data — carry the heaviest new obligations.

The consumer question is whether this converts into anything felt at the point of use. A data-subject right is only as good as the channel to exercise it, and most Ugandans interact with these firms through a USSD menu or an agent kiosk, not a compliance portal. The law creates the entitlement; the market still has to build the counter where a customer can walk up and use it. Takeaway: the Act gives consumers standing, but standing is not yet service.

The Trust Dividend: Why compliance can become a product

The more interesting shift is competitive. When every operator collected data on its own terms, trust was undifferentiated and therefore not a selling point. A statutory floor changes that. A telecom or bank that can credibly say it handles customer data lawfully — and demonstrate it — gains a reason to be chosen beyond price and coverage. In markets where switching costs are low and mobile-money agents are interchangeable, a visible commitment to data handling is one of the few durable ways to hold a customer.

That reframes compliance spending from pure cost to potential margin. The firms most exposed to the new duties are also the firms with the most to gain from being seen to meet them. Takeaway: the Act turns data stewardship into a feature customers can eventually shop on.

The Cost Pass-Through: Who pays for the new floor

Nothing here is free. Building consent records, securing databases and answering data-subject requests costs money, and in a thin-margin consumer market those costs tend to travel toward the customer through fees or slower onboarding. The near-term risk is that access narrows before it widens — that a lender tightens data practices by simply serving fewer marginal borrowers. Whether Ugandans receive lower prices and more reliable service, or merely new promises, will show up in adoption and pricing data over the coming quarters, not in the statute itself. Takeaway: measure the law by what happens to price and access, not by its text.

So What: The customer relationship is now contestable

For an operator anywhere in East Africa, the decision implication is concrete. The primary text of the Data Protection and Privacy Act is now the reference point for who may own a Ugandan customer’s data and on what terms, and Uganda’s regime will sit alongside the emerging and still-uneven privacy rules elsewhere in the bloc. A business that treats the law as a filing exercise will spend and gain nothing. One that treats lawful, legible data handling as the basis of the customer relationship can turn a compliance obligation into the reason a consumer stays. The rulebook has been written; the market for trust is now open.