Customer loyalty programmes and Uganda's data protection law

A loyalty programme is a promise in both directions. The customer promises to come back; the shop promises to remember them. Remembering means keeping a name, a phone number and a purchase history, and in Uganda that makes the shop a data collector under the Data Protection and Privacy Act. This post explains what the law asks of a small business that runs a points card or a birthday-discount list, and how to design a scheme that is worth joining.

The legal starting point

Regulation 15(1) of the Data Protection and Privacy Regulations, 2021 requires every data collector, data processor and data controller to register with the Personal Data Protection Office (PDPO), and no exemption for small businesses has been gazetted. The PDPO's decision of 18 July 2025 confirmed the duty "applies to every qualifying entity until a specific exemption is gazetted by the office". Practitioners report a fee of UGX 100,000, a registration that "is valid for one year", and an annual compliance report due within "90 days after the end of every financial year". We cover the registration itself in a separate post on customer phone numbers and the PDPO; this one is about running the scheme once you are registered.

What this means for a points card

You do not need a lawyer to run a loyalty scheme, but you do need to answer four questions in writing:

1. What do we collect? Name, phone number, purchases. Resist collecting anything you cannot explain a use for.
2. Why? To award points and send offers. That sentence goes on the sign-up form.
3. How long do we keep it? Pick a period, for example two years after the last purchase, and delete after it. That is your retention policy.
4. Who can see it? Only staff who need it. Cashiers award points; they do not export the list.

Write those four answers on one page and you have the core of the two policies the PDPO asks for.

Consent that customers understand

The practical test is whether a customer could repeat back what they agreed to. A line on the receipt or sign-up form that says "We will keep your name and number to award points and send you offers by SMS or WhatsApp. Reply STOP at any time" passes that test. A pre-ticked box on a form nobody reads does not. Keep a record of when and how each member joined; if a complaint ever reaches the PDPO, that record is your evidence.

The 2025 decision also turned on cross-border transfers. The PDPO found that a controller "is not required to seek advance permission before each cross-border transfer or storage of personal data", but must keep records of the legal basis and safeguards. If your customer list lives in a service hosted outside Uganda, know that, and say so in your privacy note.

Designing a scheme people actually use

Compliance is the floor. A scheme that nobody redeems is a cost with paperwork. Three design rules hold up across retail, pharmacies, salons and restaurants:

• Make the first reward reachable fast. A reward on the third visit teaches the habit; a reward on the twentieth never arrives.
• Reward the behaviour you want. If you want weekday trade, make weekday points worth more. If you want bigger baskets, reward spend above a threshold.
• Tell members what they have. A balance nobody knows about is not an incentive.

Measure it with two numbers: the share of sales made by members, and the share of members who have redeemed at least once. If the second number is low, the reward is too far away.

Where Kit fits

Kit CRM is built on the same customer record as the till. "Leads, deals and contacts share the POS customer record", so a loyalty member's purchase history and follow-ups are one file rather than three spreadsheets. Pipelines come "with saved views and bulk actions", which is how you send the quarterly offer to the right segment without exporting anything. Follow-up calls are logged from the Kit CRM phone app. Role-based access across Kit means the cashier who awards points is not the person who can download the list. Kit CRM is an add-on at UGX 50,000 a month on any plan, switched on from Settings, then Modules.

A one-week plan

Day one, write the four answers. Day two, register with the PDPO. Day three, fix the sign-up wording. Day four, set the first reward at visit three. Day five, pick the two numbers you will watch. A loyalty scheme run this way is both lawful and, more to the point, likely to work.

Sources

1. https://www.kaa.co.ug/registration-compliance-under-the-data-protection-and-privacy-act-2019/
2. https://itlawco.com/how-to-register-with-ugandas-personal-data-protection-office/
3. https://privacymatters.dlapiper.com/2025/08/uganda-data-protection-regulator-clarifies-compliance-requirements-for-offshore-entities/
4. https://kit.africa/products/crm/