In a massive win for digital privacy and sovereignty in East Africa, Google has officially withdrawn its appeal in a high-profile data protection case in Uganda. By dropping the challenge, the tech giant has agreed to fully comply with the country’s Data Protection and Privacy Act, signaling a major shift in how global technology corporations answer to local regulators. For the average internet user in Kampala and beyond, this confirms that your digital rights are no longer just theoretical—they are enforceable.
This development follows a decisive ruling in July 2025 by the Personal Data Protection Office (PDPO), which found Google in breach of national law. The regulator had flagged the company for operating in Uganda without registering as a data controller and for transferring personal data abroad without the necessary local safeguards in place. Rather than continuing to fight these findings in court, Google’s withdrawal indicates it now accepts the regulator's authority. Consequently, the company is moving forward with the PDPO’s requirements: registering officially, appointing a dedicated Data Protection Officer for Uganda, and submitting a clear framework for how they handle cross-border data transfers.
Ssekamwa Frank, who led the litigation team, confirmed the withdrawal in a LinkedIn post, framing it as a strengthening of the country's digital governance. “This case sends a clear message. Uganda’s data protection laws apply to all and the digital rights of Ugandans must be respected and enforced,” he wrote. He emphasized that the work is far from over, noting that the country must continue building an ecosystem where "innovation, privacy, and users’ rights remain at the centre of digital transformation."
This victory in Uganda isn't happening in a vacuum; it is part of a continent-wide awakening where African regulators are tightening the leash on Big Tech. Just recently in Nigeria, Meta reached an out-of-court settlement with the government regarding a substantial $32.8 million fine issued by the Nigeria Data Protection Commission (NDPC) for violations related to behavioral advertising. Closer to home, Uganda also secured its first criminal conviction under the data protection law earlier in 2025, when a director of a digital lending company was found guilty of unlawfully doxxing a borrower.
Ultimately, Google's decision to settle and comply marks the end of the "wild west" era of data collection in the region. It sets a precedent that regardless of size, companies operating in Uganda must play by Ugandan rules, putting the privacy and safety of local users first.