DPO Privacy Centre (East Africa), together with Tecnolegal Advisory Centre UG and human rights activist Lutaaya Godfrey, has filed a formal complaint with Uganda's Personal Data Protection Office (PDPO) requesting regulatory inquiry and oversight into the data protection implications of Uber's withdrawal from the Ugandan market.
Uber announced the wind-down of its ride-hailing operations in Uganda effective 2nd September 2026, with a driver and employee support centre remaining open until 23rd September. While the complainants do not challenge Uber's commercial decision to exit, they are raising concerns about what happens to the personal data of the riders, drivers and passengers Uber has collected since launching in Uganda in 2016.
What Key Concerns Are Raised?
The complaint asks the PDPO to determine, among other things:
- Whether Uber has notified the Office of its cessation of data processing in Uganda, as required under Regulation 25(2) of the Data Protection and Privacy Regulations, 2021;
- Whether Uber has submitted a Uganda-specific data protection exit plan, and if not, that it be required to do so;
- The categories of personal data Uber intends to retain, and the purpose, lawful basis and retention period for each;
- Whether Ugandan personal data will be transferred outside the country, to which entities, and under what safeguards, in line with Section 19 of the Data Protection and Privacy Act;
- What technical and organisational measures are being taken to secure data during the transition, per Section 20(1) of the Act; and
- How Ugandan data subjects, particularly drivers who submitted identity and verification documents, can continue to exercise their rights of access, correction, deletion and complaint after Uber ceases local operations.
The complaint draws on comparative regulatory practice, including a European Court of Justice ruling and guidance from the UK Information Commissioner's Office on businesses that cease trading, to argue that corporate exit does not extinguish data protection obligations.
Why Does This Matter?
"A market exit is, in substance, a data-governance event, and should be treated as one," the complaint states. Mobility data of the kind Uber has collected can reveal deeply personal information — for example where people live and work, their routines, and their relationships — making continued regulatory oversight essential even after a company stops operating locally.
The complainants are calling on the PDPO to require Uber to publish clear, accessible guidance for Ugandan riders, drivers and customers on how the exit affects their personal data, and to consider this case an opportunity to set a precedent for how digital platforms exiting the Ugandan market should handle accumulated personal data going forward.
Media Contact: DPO Privacy Centre (East Africa) — info@dpoprivacycentre.com
Other complainants:
- Lutaaya Godfrey, Human Rights Activist and Data Protection Advocate — lutaaygodfrey@gmail.com
- Tecnolegal Advisory Centre UG — info@tecnolegaladvisory.com