Table of Contents
KAMPALA, UGANDA — On Tuesday, August 18, 2026, social networking giant TikTok Pte. Ltd. formally issued a public notice confirming its official registration with Uganda’s Personal Data Protection Office (PDPO).
The registration brings TikTok’s operations, algorithms, and handling of user data strictly under the regulatory requirements of Uganda’s Data Protection and Privacy Act (Cap 97).
For the estimated 11 million Ugandans who scroll, post, stream, and conduct business on TikTok every day, the development marks a major shift in how the platform interacts with local laws.
As part of the statutory requirements, TikTok has designated a local Data Protection Officer (DPO) through Kampala-based law firm Engoru Mutebi Advocates, located at Ericsson House on Akii Bua Road in Nakasero.
This means that for the first time since TikTok exploded in popularity across the country, Ugandan citizens whose personal identification details, private videos, telephone numbers, or academic documents are posted online without consent have a physical legal office in Kampala where they can file formal data privacy complaints.
However, the registration has also sparked confusion online, with users asking whether local registration means the government will monitor their private messages, whether banned accounts can now be unblocked in Nakasero, or if citizens can sue the tech giant in Ugandan courts.
Below is a detailed breakdown of what TikTok’s formal registration with the PDPO means, what it changes for content creators and everyday viewers, and how you can exercise your legal rights under Ugandan law.
Why has TikTok officially registered with the Data Protection Office in Uganda?
Under Section 29 of Uganda’s Data Protection and Privacy Act (Cap 97) and Regulation 15 of the Data Protection and Privacy Regulations, every public or private organization that collects, processes, stores, or uses personal data belonging to Ugandan citizens is legally required to register with the Personal Data Protection Office (PDPO).
Until recently, global social media platforms operated in a legal gray area across much of Africa, collecting massive volumes of user data while maintaining no physical or legal footprint within host countries.
Speaking on the development, Uganda Communications Commission (UCC) Executive Director Nyombi Thembo described TikTok’s registration as a necessary step for consumer safety in an increasingly digital economy.
According to UCC statistics, TikTok is currently the dominant driver of internet traffic in Uganda. While WhatsApp maintains a slightly higher subscriber base, TikTok accounts for over 56 percent of total Over-The-Top (OTT) mobile data consumption in the country.
“TikTok carries the day in Uganda,” Nyombi Thembo noted. “Over 21 million smartphones are actively in use and platforms such as TikTok reach millions, so regulation has become an essential rather than an option for ensuring safety and accountability.”
By registering with the PDPO, TikTok has formally committed to complying with statutory data protection principles, ensuring that the personal information it collects from Ugandan phone numbers and IP addresses is stored, processed, and protected in accordance with national laws.
What personal data does the app collect from Ugandan users?
Many users assume TikTok only sees the public videos posted on their feeds. In reality, modern short-form video platforms collect extensive layers of personal information the moment an app is installed on a smartphone.
Lawyer Timothy Kajja, an associate partner at Engoru, Mutebi Advocates—the law firm designated as TikTok’s local DPO representative—explains that personal data covers any piece of information that can directly or indirectly identify a living human being.
When you use TikTok in Uganda, the platform collects data across several categories:
- Direct Personal Identifiers: Your full name, email address, phone number, date of birth, profile photos, and linked social media accounts provided during registration.
- Biometric & Audio Data: Facial recognition patterns used for video filters, voice recordings extracted from original audio uploads, and speech-to-text captions.
- Technical & Device Identifiers: Your phone’s IP address, device serial number (IMEI), mobile network provider (e.g., MTN or Airtel), SIM card details, operating system, and precise GPS location data.
- Behavioral & Financial Data: In-app purchase history, mobile money or credit card details used to send virtual gifts to live streamers, watch time history, private direct messages, and contacts synced from your phone address book.
Under Cap 97, collecting this vast web of information requires clear user consent, a specific lawful purpose, and strict security measures to prevent unauthorized leaks to third-party advertisers or cybercriminals.
Can you now sue TikTok in Ugandan courts if your data is leaked?
Yes. One of the most significant legal consequences of TikTok registering with the PDPO is that the company has submitted itself to the jurisdiction of Uganda’s legal framework.
Previously, if a Ugandan citizen suffered a severe privacy breach on TikTok—such as an unauthorized leak of private medical records, leaked personal photos, or financial fraud—taking legal action required attempting to serve court documents to ByteDance offices in Singapore, China, or the United States, a process that was financially impossible for ordinary citizens.
UCC Executive Director Nyombi Thembo emphasized that local registration closes this enforcement gap:
“Privacy and data protection laws provide that any entity that collects data has to be registered with the Data Protection Office to ensure that they comply with data protection rules,” Thembo explained. “If there is any data breach, you can sue them. That should not worry anybody.”
Furthermore, Uganda’s judicial system has demonstrated a willingness to criminally prosecute data privacy violations. In July 2025, the Standards, Utilities and Wildlife Court delivered a landmark criminal conviction under the Data Protection and Privacy Act against a digital microfinance director who created videos exposing a borrower’s photo, name, and phone number on social media over an unpaid loan.
With TikTok formally registered, any intentional or negligent failure by the platform to safeguard personal data can now form the basis of a formal complaint to the PDPO or a civil lawsuit in Ugandan courts.
Does this registration mean the government will monitor your videos or ban accounts?
No. A common misconception following the public notice is that registering with the PDPO allows state security agencies or the UCC to spy on private TikTok direct messages or order instant account bans.
Baker Birikujja, the National Personal Data Protection Director at the PDPO, clarified that the registration process is an administrative requirement for corporate bodies, not a mechanism for state surveillance over individual citizens.
“The office does not register users; it registers organisations,” Birikujja stated. “When an organisation registers, it is required to have a compliance person who ensures that it complies with the law on how it collects, uses and protects personal information.”
The registration does not grant the government access to user passwords, nor does it alter TikTok’s existing Community Guidelines regarding free expression, political satire, or creator monetization.
Criminal offenses committed on the platform—such as making direct threats of violence, hate speech, or impersonating military personnel—remain subject to standard law enforcement investigations under the Computer Misuse Act and Penal Code Act, entirely separate from the PDPO.
How do you report a privacy violation or leaked documents to TikTok in Uganda?
Prior to this registration, if a rogue user uploaded your sensitive personal documents—such as your National ID (NIN), passport bio-page, academic transcripts, or private contact details—getting the content removed required submitting automated in-app reports that were often handled by distant AI bots with little understanding of local context.
Under the new regulatory setup, you can lodge a formal privacy complaint directly through TikTok’s designated local representative.
PDPO Director Baker Birikujja used the example of sensitive document leaks to illustrate how the new local contact functions:
“The law requires organisations that collect personal information to have a point of contact where people can raise concerns,” Birikujja explained. “For example, if someone posts your academic documents or passport online and you consider that information sensitive, instead of running around, you can contact the organisation’s designated data protection contact.”
Official Contact Channels for Data Privacy Concerns in Uganda:
- Physical Delivery: Address formal written privacy complaints to the Data Protection Officer, TikTok Pte. Ltd., located at Engoru Mutebi Advocates, 1st Floor, Ericsson House, Plot 24B Akii Bua Road, Nakasero, Kampala.
-
Regulatory Escalation: If TikTok’s local DPO fails to respond or resolve a verified data leak within reasonable statutory timelines, citizens can escalate the grievance directly to the Personal Data Protection Office (PDPO) via their official web portal (
pdpo.go.ug) or physical offices at the Ministry of ICT and National Guidance.
Will the local office help you unban or recover a suspended account?
No. It is crucial for content creators and casual users to understand the strict boundary between data privacy laws and platform terms of service.
TikTok explicitly clarified in its August 18 public notice that the appointment of a local DPO applies strictly to personal data protection and privacy matters under Cap 97.
If your TikTok account is suspended or banned for:
- Violating Community Guidelines (e.g., copyright infringement, adult content, dangerous challenges)
- Losing access to your login email or password
- Disputes over live-stream gifting payments or Creator Fund payouts
These operational disputes cannot be handled by Engoru Mutebi Advocates or the PDPO. Account appeals, shadowban reviews, and technical support will continue to be processed through TikTok’s standard global in-app support channels and international Terms of Service.
Timothy Kajja from Engoru Mutebi Advocates summarized the distinction clearly:
“Having safeguards does not mean that there will be a 100 percent guarantee that your privacy rights will never be violated,” Kajja noted. “However, this development means that if your personal data or privacy rights are violated, TikTok now has a Data Protection Officer who provides a formal channel through which you can lodge a complaint.”
What rights do you have under Uganda’s Data Protection and Privacy Act?
The formal registration of major tech platforms serves as a timely reminder that Ugandans possess enforceable digital rights under the law.
Under the Data Protection and Privacy Act (Cap 97), every citizen (referred to legally as a “Data Subject”) holds six core statutory guarantees regarding how companies handle their personal records:
- Right to Prior Consent: No company can collect or process your personal data without your explicit, informed consent. You retain the legal right to withdraw that consent at any time.
- Right of Access: You have the legal right to ask any registered company to disclose what personal data they hold about you, how it was gathered, and who it has been shared with.
- Right to Correction: If an organization holds inaccurate, outdated, or misleading personal information about you, you can demand an immediate correction free of charge.
- Right to Erasure (“Right to be Forgotten”): You can demand the permanent deletion of your personal records if the data was collected unlawfully or is no longer necessary for the original purpose.
- Purpose Limitation: Companies are strictly prohibited from collecting your data for one reason (e.g., app registration) and selling or using it for an unrelated commercial purpose (e.g., third-party direct marketing) without separate approval.
- Mandatory Breach Notification: If a company experiences a database hack or data leak that compromises user information, it is legally required to notify both the PDPO and affected citizens immediately.
As Uganda’s digital economy expands, the formal registration of global tech platforms like TikTok establishes an important precedent.
By bringing international tech giants under local regulatory oversight, Uganda ensures that rapid digital growth does not come at the expense of fundamental human privacy, personal dignity, and constitutional rights.
