In a decision issued on 18 July 2025 against Google LLC, the Personal Data Protection Office (PDPO) has affirmed that the data protection compliance obligations under Ugandan law apply to all entities that handle the personal data of Ugandan citizens, regardless of where they are based. The office has also clarified that a data controller or processor is not required to seek advance permission before each cross-border transfer or storage of personal data. However, it must maintain proper records of the legal basis, safeguards and justification for such transfers, which records must be available for inspection during audits, compliance checks or investigations. [Ssekamwa Frank & 3 others v. Google LLC., Complaint No. 08/11/24/6683]
Paul Mbuga is a commercial and infrastructure lawyer, and his core practice areas include corporate and commercial law (including M&A and private equity), capital markets (regulation and transactions), projects and infrastructure and regulatory compliance. Paul advises corporate, financial and infrastructure entities on a wide range of legal, regulatory and transactional matters, working with in-house counsel, within the business operation and as local counsel.
Experience has included advising:
- The issuer for the listing of a medium-term note programme (corporate bond)
- National Social Security Fund for its US$ 50 million 30% equity subscription in the Kampala Marriott Hotel licensee entity
- MTN Group and MTN Uganda for the structural separation and reorganisation of MTN Uganda’s mobile money and fintech subsidiary, MTN Mobile Money
- Tourvest South Africa for its acquisition of the business and assets of Wild Frontiers
- MTN Group and MTN Uganda for the follow-on secondary market sale of 7.05% shareholding in MTN Uganda, resulting in a subscription rate of 230%
- MTN Group and MTN Uganda for MTN Uganda’s US$ 150 million initial public offer and listing
- Stanbic Bank and Centenary Bank in two separate corporate reorganisations by which the two banks created a holding company structure
- TotalEnergies for its downstream petroleum company amalgamation with GAPCO Uganda
- The target company and the disposing majority shareholder for a combined US$ 10.6 million equity purchase and share subscription
- dfcu Group for its US$ 55 million rights issue
- AMEA Power for the establishment of the 20 MWac Madi-Okollo solar power plant, including acting as sponsors’ counsel for a project financing facility by the Emerging Africa and Asia Infrastructure Fund
- TotalEnergies for the proposed establishment of a 20MWac solar power plants in Tororo District
Professional Qualifications
- Advocate admitted to the High Court of Uganda.
Education
- University of Birmingham: Master of Laws (International Commercial Law).
- Makerere University: Bachelor of Laws.
- Law Development Centre: Post-Graduate Diploma in Legal Practice (bar qualification).
Memberships
- Member of the East African Law Society.
- Member of the Uganda Law Society.
“ESG” (Environmental, Social, and Governance) has arguably become the most popular acronym in corporate boardrooms around the world: ESG goals; ESG strategies; ESG opportunities. In more advanced jurisdictions, a significant number of companies and organizations already have ESG policies in place and are recruiting ESG compliance and reporting officers to build and manage their ESG profiles. On the other hand, the corporate response to ESG in developing countries is still slow and divided.
The government of Uganda tabled the Competition Bill 2022 before parliament in December 2022, marking what has been a long-awaited initiative by the state to finally translate years of both policy and political positioning on the regulation of competition into actual legislation.