A new government initiative requiring Uganda’s coffee farmers to register their personal details before exporting coffee to Europe has sparked growing concern over data privacy and compliance with national laws.
The exercise, led by Pula Advisors Uganda Ltd, has drawn criticism after the company reportedly warned farmers that their coffee would not be bought unless they registered. Critics say the ultimatum violates Uganda’s data protection laws and risks exposing farmers’ private information to misuse.
The Personal Data Protection Office (PDPO) has since intervened, writing to the Ministry of Agriculture, Animal Industry and Fisheries (MAAIF) to comply with the Data Protection and Privacy Act, 2019, by formally registering with the PDPO as a data controller.
‘We wish to draw your attention to Section 29 (2) of the Data Protection and Privacy Act, Cap 97, which mandates every person, institution, or public body that collects or processes personal data to register with the PDPO,’ wrote Mr Baker Birikujja, the National Personal Data Protection Director, in an October 27, 2025 letter to the ministry.
‘While Pula Advisors Uganda Ltd is registered as a data processor, the ministry is required to register with the PDPO in its capacity as a data controller, since it determines the purposes and means of processing the data collected,’ he added.
The PDPO further cautioned the ministry about transferring Ugandan citizens’ data to foreign jurisdictions without proper safeguards.
‘Section 19 of the Act requires that any data controller or processor based in Uganda who transfers or stores personal data outside the country ensures that the destination jurisdiction provides data protection safeguards equivalent to those prescribed under Ugandan law,’ Mr Birikujja said.
‘Before any transfer or sharing of personal data with entities in the European Union, the ministry must conduct an adequacy assessment to confirm that the receiving country affords adequate protection.’
The complaint that triggered the PDPO’s intervention was filed by Counsel Peter Magelah, who argued that the ministry should first comply with Uganda’s data protection and privacy laws before sending citizens’ personal data to the European Union (EU).
‘We are not against digital registration,’ Mr Magelah said, ‘but the process must follow the law. You cannot force farmers to hand over their personal information to a private company without clear data safeguards.’
According to government figures, 2.8 million coffee farmers have already been registered, double the initial projection, as part of Uganda’s efforts to comply with the EU Deforestation-Free Products Regulation (EUDR), which takes effect on January 1, 2026.
The digital registration is a requirement under the new regulation, intended not for taxation but to ensure that all coffee exported to the EU can be traced to its source and verified as environmentally sustainable.
Europe remains one of Uganda’s biggest coffee markets, accounting for the majority of the country’s annual coffee exports. However, stakeholders warn that unless Uganda ensures legal and ethical compliance in its data collection process, the initiative could backfire by violating citizens’ rights and undermining public trust.