Understand Uganda’s Grid
Map Vision 2040
Quick Links
Get Intouch
Tel: +256-417 802 000
Tel: +256-314 802 000
Email: transco@uetcl.com
Plot No.10, Hannington Rd,
P.O Box 7625,
Kampala, Uganda
1.0. PURPOSE
Uganda Electricity Transmission Company Limited (UETCL) respects the privacy of all individuals whose personal data it processes in the execution of its statutory mandate
This Privacy Policy applies to UETCL’s websites, digital platforms, systems, and services that reference or link to this Policy.
This Policy explains how UETCL collects, processes, stores, protects, and discloses personal data in accordance with:
- Data Protection and Privacy Act, 2019(Cap 97) and its Regulations, 2021
- ISO/IEC 27001:2022(where applicable)
- International data protection and privacy principles.
This Policy describes:
- How We Collect and Use Personal Data
- Cookies and Similar Technologies
- How We Disclose Personal Data
- How to Access and Control Your Personal Data
- How We Protect Personal Data
- How We Process Children’s Personal Data
- Third-Party Service Providers
- International Transfer of Personal Data
- Updates to this Policy
2.0. SCOPE
This Privacy Policy applies to:
- All departments and operational units of UETCL
- All employees, consultants, contractors, and governance members
- All service providers, partners, suppliers, and third parties processing personal data on behalf of UETCL
- All systems, websites, platforms, and services operated by UETCL.
The Policy applies to all personal data held by UETCL relating to identifiable individuals, meaning any information relating to an identified or identifiable natural person (data subject).
This Privacy Policy:
Implements internationally accepted privacy principles
- Aligns with the Data Protection and Privacy Act, Cap 97
- Supports UETCL’s Data Protection and Privacy Policy and Procedures Manual
Where national legislation imposes stricter requirements, the provisions of the national law shall prevail.
Each department of UETCL is responsible for ensuring compliance with this Policy and applicable data protection laws.
3.0. DEFINITIONS
| Term | Meaning |
| Personal Data | Any information relating to an identified or identifiable natural person. |
| Data Subject | An individual whose personal data is processed. |
| Data Controller | UETCL – the entity that determines the purposes and means of processing personal data. |
| Data Processor | A person or organization that processes personal data on behalf of UETCL. |
| Data Protection Officer (DPO) | The Head of ICT, appointed to oversee data protection compliance. |
| Cookies | Small text files stored on a user’s device when visiting a website. |
| User | Any individual accessing UETCL websites, services, or platforms. |
4.0. WHAT DATA DO WE COLLECT?
Depending on the services provided by UETCL, we may collect the following categories of personal and technical data.
4.1. Employee and Contractor Information
- Full Name
- National Identification Number
- Employee/Contractor ID
- Contact details (email, phone, address)
- Bank account details (for payroll and compensation)
- Employment history and qualifications
- Health and safety data (where required by law)
4.2. Stakeholder and Project‑Affected Person (PAP) Information
- Full Name
- National Identification Number
- Contact details
- Land ownership and wayleave information
- Bank account or mobile money details (for compensation)
4.3. Technical and system data
When interacting with UETCL digital platforms we may collect:
- Internet Protocol (IP) Address
- Browser Type and Version
- Operating System and Device Information
- Website activity logs
4.4. Operational and regulatory data
- Procurement and contract documentation
- Regulatory compliance reports
- Communications submitted to UETCL
5.0. HOW WE COLLECT AND USE PERSONAL DATA
5.1. Collection methods:
- Directly from individuals (forms, applications, correspondence)
- Automatically through website technologies (cookies)
- Through regulatory submissions and contractual agreements
5.2. Purposes of processing:
- Transmission grid operation and maintenance
- Wayleave acquisition and land compensation
- Human resource management
- Procurement and contract administration
- Regulatory compliance, audits, and reporting
- Responding to inquiries and requests
- Improving UETCL services and digital platforms
6.0. LAWFUL BASIS FOR PROCESSING
UETCL processes personal data based on the following lawful bases under the Data Protection and Privacy Act, Cap 97:
- Performance of a statutory or public function (e.g., grid operation, wayleave acquisition)
- Compliance with a legal obligation (e.g., tax, labour laws)
- Performance of a contract (e.g., employment, procurement)
- Consent of the data subject (where no other basis applies)
- Protection of vital interests
- Legitimate interests pursued by UETCL that do not override individual rights
7.0. COOKIES
UETCL websites may use cookies to:
- Maintain session security
- Improve website performance
- Remember user preferences
- Analyse website usage
Users may configure their browsers to refuse or delete cookies, although some website functionality may be affected.
8.0. DISCLOSURE OF PERSONAL DATA
UETCL may disclose personal data:
- To government ministries, departments, and agencies (e.g., Ministry of Energy, ERA)
- To regulators (e.g., Electricity Regulatory Authority, PDPO)
- To courts or law enforcement agencies where required by law
- To authorised service providers and contractors under Data Processing Agreements (DPAs)
- During lawful regulatory investigations
All disclosures are conducted in compliance with the Data Protection and Privacy Act, Cap 97.
9.0. DATA SUBJECT RIGHTS
Individuals have the right to:
- Be informed about the processing of their personal data
- Access their personal data
- Request correction of inaccurate or incomplete data
- Request erasure (right to be forgotten) where applicable
- Restrict processing in certain circumstances
- Object to processing (e.g., for direct marketing or based on public interest)
- Data portability
- Protection against automated decision‑making
Requests may be submitted to the Data Protection Officer at dpo@uetcl.com or using the prescribed UETCL Data Protection and Privacy Policy and Procedures manual forms (DPP‑01, DPP‑02, DPP‑03).
10.0. PROTECTION OF PERSONAL DATA
UETCL protects personal data using administrative, technical, and physical safeguards, including:
- Encryption (at rest and in transit)
- Role‑based access controls
- Multi‑factor authentication (MFA)
- Network security monitoring
- Staff privacy and security training
- Secure data storage and processing environments
These controls align with the UETCL Data Protection and Privacy Policy and Procedures Manual and, where applicable, ISO/IEC 27001 principles.
11.0. PERSONAL DATA BREACH MANAGEMENT
UETCL maintains an incident response process for handling personal data breaches.
In the event of a breach, UETCL will:
- Investigate and assess the breach (within 24 hours of discovery)
- Contain and mitigate risks
- Notify the Personal Data Protection Office (PDPO) within 72 hours
- Notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms
- Document the breach in a Breach Register
12.0. DATA RETENTION
Personal data will only be retained for as long as necessary to:
- Fulfil operational and regulatory requirements
- Comply with legal obligations
- Support audits and investigations
Specific retention periods are defined in the UETCL Records and Document Management Policy. Data will be securely destroyed (cross‑cut shredding for paper, certified erasure for electronic) upon expiry of the retention period.
13.0. CHILDREN’S PERSONAL DATA
UETCL’s services are primarily intended for adults. Where personal data relating to minors is processed (e.g., in the context of employee dependants or internship applications), consent must be obtained from a parent or legal guardian.
14.0. THIRD PARTY SERVICE PROVIDERS
UETCL may engage third‑party data processors (e.g., valuers, IT service providers). All such processors must sign a Data Processing Agreement (DPA) that imposes the same data protection obligations as this Policy and the law.
15.0. INTERNATIONAL TRANSFER OF PERSONAL DATA
UETCL shall not transfer personal data outside Uganda unless:
- The recipient country has adequate data protection laws as determined by the Authority, or
- Appropriate safeguards (e.g., standard contractual clauses) are in place, or
- The data subject has provided explicit consent.
The DPO maintains a record of all international data transfers.
16.0. POLICY UPDATES
UETCL may update this Privacy Policy periodically to reflect legal, regulatory, or operational changes. Updated versions will be published on UETCL’s official website and internal platforms.
17.0. POLICY REVIEW
This Privacy Policy shall be reviewed:
- Annually
- After significant regulatory or operational changes
- After a major personal data breach
The review will be led by the Data Protection Officer in consultation with the Governance, Ethics, and Compliance and ICT departments.
18.0. CONTACT INFORMATION
For any questions, requests, or complaints regarding this Privacy Policy or the handling of your personal data, please contact:
Data Protection Officer (DPO)
Uganda Electricity Transmission Company Limited
Plot No. 10, Hannington Road, Kampala, Uganda
Email: dpo@uetcl.com
Telephone: +256 417 802 000