A law passed in Kampala rarely stops at the border, and this one is built to travel awkwardly. Uganda has enacted the Data Protection and Privacy Act, setting rules for how personal data is collected, processed, stored and transferred. The domestic story is compliance; the regional story is friction. For any business that runs a single customer database across East Africa, Uganda has just added another set of national rules to reconcile — and that patchwork, not the Ugandan statute alone, is where the regional opportunity and the regional cost both sit.

The Patchwork: One region, many rulebooks

Data does not respect the map the way goods do. A regional bank headquartered in Nairobi, a telecom group operating across three markets, an agritech platform pulling farmer records from several countries — all of them now move personal data across lines where the rules differ. Uganda’s Act adds a defined regime where there was previously little, but it enters a bloc in which comprehensive privacy law is uneven, with several neighbours still drafting theirs. The near-term reality for cross-border operators is not a single market but a set of overlapping national obligations that must be mapped one country at a time. A payment processor clearing transactions in Kampala and Nairobi cannot assume that a practice lawful in one capital is lawful in the other, and the cost of getting that wrong is borne where the data originates. The compliance function that once needed a single rulebook now needs a comparative one, kept current as each neighbour legislates. Takeaway: the region’s data map is now more detailed and less uniform at the same time.

The Transfer Question: Where data may go

The Act’s provisions on transferring personal data are the ones with the sharpest regional edge. Rules governing where and under what conditions Ugandan personal data may be sent abroad shape decisions about where regional firms locate their servers, their processing and their support operations. A company that once defaulted to a single hub for the whole bloc now has to ask whether that hub satisfies each source country’s transfer conditions. This is the same problem European firms confronted when cross-border transfer rules tightened, localised to an East African context. For a group that has centralised its data operations to save cost, the Act reopens a settled decision: the efficient hub and the compliant hub may no longer be the same place. Takeaway: the location of infrastructure becomes a legal question, not only a technical one.

The Harmonisation Prize: A regional market still to be built

The friction points to the prize. The bloc already speaks the language of integration through the EAC Customs Union and Common Market, and the continent through AfCFTA, yet digital rules remain national. Whichever way the region moves — toward mutual recognition of adequate regimes or toward continued divergence — the firms that map the patchwork early will carry a real advantage when a more common standard eventually arrives. Uganda having a defined law is a building block; a harmonised regional standard is the structure that block could one day support. Takeaway: today’s compliance cost is a down-payment on a future single digital market.

So What: Build for the patchwork, plan for the standard

For a regional operator, the decision is practical and immediate. Read the enacted Ugandan text against the rules — or the drafts — in each other market you serve, and design data flows that satisfy the strictest applicable condition rather than the most convenient one. That is more expensive now, but it is the only architecture that survives further national laws being passed around you. Uganda has moved first among several. The businesses that treat this as the opening move in a regional realignment, rather than a one-country compliance chore, will be the ones positioned when the rest of East Africa catches up.