In a decision issued on 18 July 2025 against Google LLC, the Personal Data Protection Office (PDPO) has affirmed that the data protection compliance obligations under Ugandan law apply to all entities that handle the personal data of Ugandan citizens, regardless of where they are based. The office has also clarified that a data controller or processor is not required to seek advance permission before each cross-border transfer or storage of personal data. However, it must maintain proper records of the legal basis, safeguards and justification for such transfers, which records must be available for inspection during audits, compliance checks or investigations. [Ssekamwa Frank & 3 others v. Google LLC., Complaint No. 08/11/24/6683]
Paul Mbuga is a commercial and infrastructure lawyer, and his core practice areas include corporate and commercial law (including M&A and private equity), capital markets (regulation and transactions), projects and infrastructure and regulatory compliance. Paul advises corporate, financial and infrastructure entities on a wide range of legal, regulatory and transactional matters, working with in-house counsel, within the business operation and as local counsel.
Experience has included advising:
- MTN Group and MTN Uganda for the follow-on secondary market sale of 7.05% shareholding in MTN Uganda, resulting in a subscription rate of 230%.
- MTN Group and MTN Uganda for MTN Uganda’s US$ 150 million initial public offer and listing - the first telecommunications sector public offer in Uganda; the largest ever public offer in the history of the Ugandan capital markets; the first public offer to utilise digital channels (including mobile money) and the largest public offer in Africa in 2021.
- The publicly-traded Stanbic Bank, Uganda’s largest bank, on a corporate reorganisation by which the bank created a holding company structure [Stanbic Uganda Holdings].
- Centenary Bank, Uganda’s largest indigenous bank, on a corporate reorganisation by which the bank created a holding company structure [Centenary Group].
- A leading private hospital and the disposing majority shareholder for a combined US$ 10.6 million equity purchase and share subscription by Investment Fund for Health in Africa
- The lenders, led by the International Finance Corporation and the African Development Bank, for the US$ 403 million project re-financing of the 250 MW Bujagali II hydro power dam.
- AMEA Power on the establishment of a 20 MWac solar power plant in Madi-Okollo District, including acting as sponsors’ counsel for a project financing facility by the Emerging Africa Infrastructure Fund.
Professional Qualifications
- Advocate admitted to the High Court of Uganda.
Education
- University of Birmingham: Master of Laws (International Commercial Law).
- Makerere University: Bachelor of Laws.
- Law Development Centre: Post-Graduate Diploma in Legal Practice (bar qualification).
Memberships
- Member of the East African Law Society.
- Member of the Uganda Law Society.
“ESG” (Environmental, Social, and Governance) has arguably become the most popular acronym in corporate boardrooms around the world: ESG goals; ESG strategies; ESG opportunities. In more advanced jurisdictions, a significant number of companies and organizations already have ESG policies in place and are recruiting ESG compliance and reporting officers to build and manage their ESG profiles. On the other hand, the corporate response to ESG in developing countries is still slow and divided.
The government of Uganda tabled the Competition Bill 2022 before parliament in December 2022, marking what has been a long-awaited initiative by the state to finally translate years of both policy and political positioning on the regulation of competition into actual legislation.