Confidentiality and data protection policy

Focus on Recovery Uganda (FORE) is committed to protecting the confidentiality, privacy, security and integrity of personal information entrusted to the organization by its clients, staff, volunteers, interns, families, donors, partners, service providers and other stakeholders.

FORE shall collect, process, store, use and share personal data responsibly, lawfully, fairly and transparently, in accordance with the applicable laws and regulations of Uganda, including the Data Protection and Privacy Act, 2019 and applicable regulations.

FORE shall take reasonable organizational administrative, physical and technical measures to prevent unauthorised access, loss, misuse, disclosure, alteration or destruction of personal data.

The purpose of this policy is to:

1. ensure compliance with applicable data protection and privacy laws and regulations;
2. protect the confidentiality, integrity and availability of personal and sensitive data;
3. establish clear requirements for the collection, processing, storage, use, sharing and disposal of personal data;
4. safeguard the rights and privacy of data subjects; and
5. promote a culture of confidentiality, accountability and responsible data management within FORE.

This policy applies to:

1. clients and their families;
2. employees, volunteers and interns;
3. consultants, contractors and third-party service providers;
4. donors, partners, collaborators and other stakeholders; and
5. any person who collects, accesses, processes, stores, shares or otherwise handles personal data on behalf of FORE.

The policy applies to personal data held in electronic, paper, photographic, audio, video and any other form.

For purposes of this policy:

1. Data Subject means an identified or identifiable individual whose personal data is collected or processed by FORE.
2. Data Controller means FORE where it determines the purposes and means of collecting and processing personal data.
3. Data Processor means a person or entity that processes personal data on behalf of FORE or another data controller.
4. Data Collector means an authorized person or system responsible for collecting personal data, such as an intake officer, therapist, medical specialist, legal representative or HR officer.
5. Personal Data means information relating to an identified or identifiable individual, including names, telephone numbers, identification numbers, photographs, fingerprints, family and emergency contact details and other information that can identify an individual directly or indirectly.
6. Sensitive Personal Data means personal information that requires heightened protection because its disclosure or misuse may cause harm, discrimination, distress or other significant consequences. This includes medical history and diagnosis, psychological assessments, prescribed medication, treatment plans, therapy or staff notes, complaints, grievances, case reviews and decisions concerning a person's treatment or support.
7. Confidential Information means information that is not publicly available and is considered private or sensitive, including client records, internal policies, financial information, donor information, strategic plans, employee records and confidentiality agreements.
8. Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure, sharing, alteration or deletion.
9. Consent means a voluntary, informed and specific indication by which a data subject agrees to the processing of their personal data where consent is the appropriate lawful basis.
10. Data Breach means an incident that results in the unauthorised access, disclosure, loss, alteration, destruction or compromise of personal data.

FORE shall ensure that personal data is:

1. processed lawfully, fairly and transparently;
2. collected for specified, explicit and legitimate purposes;
3. adequate, relevant and limited to what is necessary;
4. accurate, complete and kept up to date where necessary;
5. retained only for as long as reasonably necessary for its purpose or as required by law;
6. protected against unauthorized access, disclosure, loss, alteration or destruction; and
7. processed in a manner that respects the rights and dignity of the data subject.

FORE shall collect and process personal data only for legitimate and specified purposes, including service delivery, safeguarding, administration, human resource management, monitoring and evaluation, reporting, financial management and other authorised organisational purposes.

1. Data shall be collected directly from the data subject where reasonably practicable.
2. Data subjects shall be informed, in an understandable manner, of the purpose for which their information is being collected and how it may be used or shared.
3. FORE shall obtain consent where consent is the applicable lawful basis for processing.
4. Personal data shall not be collected or used for purposes that are incompatible with the purpose for which it was originally obtained, unless permitted by law or otherwise appropriately authorised.
5. Only information that is reasonably necessary for the intended purpose shall be collected.

Because FORE may handle health, psychological, therapeutic and other sensitive information, such information shall receive enhanced protection.

1. Access to sensitive information shall be restricted to authorised persons who require it for legitimate professional or organisational purposes.
2. Sensitive information shall not be discussed in public areas or with unauthorised persons.
3. Staff shall exercise particular care when transmitting, printing, copying or storing sensitive information.
4. Photographs, audio recordings and videos containing identifiable individuals shall only be collected or used for an authorised purpose and, where required, with appropriate consent.
5. Information concerning a client shall not be disclosed to family members, external professionals or other parties unless authorised, necessary and permitted by law or appropriately consented to.

All FORE staff, volunteers, interns, consultants and service providers are required to maintain the confidentiality of information accessed through their work.

1. Confidential information shall only be accessed for legitimate and authorized purposes.
2. The need to know principle shall apply, and access shall be limited to information necessary for a person's assigned responsibilities.
3. Confidential information shall not be disclosed to unauthorized persons during or after employment, volunteering, internship or contractual engagement with FORE.
4. Persons handling confidential information may be required to sign confidentiality or data protection undertakings.

FORE recognizes the rights of data subjects under applicable data protection laws.

Subject to applicable legal limitations, data subjects may request:

1. access to their personal information;
2. correction of inaccurate or incomplete information;
3. deletion or removal of personal information where legally applicable;
4. information concerning how their personal data is being processed;
5. withdrawal of consent where consent is the applicable basis for processing; and
6. an opportunity to raise concerns or complaints regarding the handling of their personal data.

FORE shall establish appropriate procedures for receiving, verifying, recording and responding to such requests.

FORE shall not disclose personal data except where there is a legitimate and authorized purpose.

1. Information may be shared internally on a need to know basis.
2. Information may be shared with authorized third parties where necessary for service delivery, legal compliance, safeguarding, contractual obligations or other legitimate purposes.
3. Where required, appropriate consent shall be obtained before information is shared.
4. Third parties receiving FORE information shall be required to maintain appropriate confidentiality and data protection safeguards.

FORE shall exercise reasonable due diligence when engaging persons or organizations that process personal data on its behalf.

1. Appropriate confidentiality and data processing obligations shall be included in relevant contracts or agreements.
2. Processors shall only process information for authorized purposes and in accordance with FORE's instructions.
3. FORE shall take reasonable steps to ensure that third party processors maintain appropriate security measures.
4. Third parties shall promptly report any actual or suspected data breach involving FORE information.

FORE shall implement appropriate physical, administrative and technical safeguards to protect personal data. These measures shall include, as appropriate:

1. encryption of personal data in transit and at rest;
2. passwords, access controls and role based permissions;
3. secure storage of physical records;
4. regular backups and appropriate disaster recovery arrangements;
5. protection of computers and other electronic devices against unauthorized access and malicious software;
6. secure disposal of records and electronic information; and periodic review of user access rights.
7. Staff shall not share passwords or leave confidential information accessible to unauthorized persons.

FORE shall use reasonable safeguards when communicating or storing personal data electronically.

1. Confidential information should be transmitted through secure and authorized communication channels.
2. Staff shall exercise caution when using email, messaging applications, cloud services, removable storage and personal devices.
3. Sensitive information shall not be stored on personal devices or personal accounts unless expressly authorized and adequately protected.
4. Access to FORE systems shall be withdrawn when a staff member, volunteer, intern or contractor leaves the organisation or no longer requires access.

FORE shall retain personal data only for as long as necessary for the purpose for which it was collected or as required by applicable law, professional obligations, contractual requirements or legitimate organisational needs.

1. FORE shall maintain appropriate retention periods for different categories of records.
2. Records that are no longer required shall be securely destroyed or permanently deleted.
3. Paper records containing confidential information shall be securely shredded or otherwise destroyed.
4. Electronic records shall be securely deleted in accordance with applicable procedures.

FORE shall, where appropriate, assess privacy and data protection risks before introducing new systems, technologies or activities involving significant amounts of personal or sensitive data. Such assessments shall consider the type of data involved, purpose of processing, access, security risks, retention and measures required to protect data subjects.

FORE shall maintain procedures for identifying, reporting, containing, investigating and responding to actual or suspected data breaches.

1. Staff shall immediately report suspected loss, unauthorized access, disclosure or compromise of personal data to the designated responsible person.
2. FORE shall assess the nature and seriousness of the incident and take appropriate measures to contain and remedy it.
3. Where required by law, FORE shall notify the relevant authority and affected data subjects within the applicable legal timeframe.
4. FORE shall document significant data breaches and implement corrective measures to reduce the likelihood of recurrence.

FORE shall provide regular data protection and confidentiality training to relevant staff, volunteers and other persons handling personal data. The training shall aim to:

1. strengthen understanding of confidentiality and data protection principles;
2. promote compliance with applicable Ugandan laws and regulations;
3. equip personnel with practical skills for securely handling personal and sensitive data;
4. increase awareness of cyber threats and other data security risks; and
5. promote privacy, accountability and ethical data management.

The Executive Director shall provide overall leadership and ensure that FORE has appropriate resources and systems for implementing this policy.

1. The designated Data Protection Officer or responsible person shall coordinate data protection compliance, advise management and staff, monitor implementation and support responses to data-subject requests and incidents.
2. Managers and supervisors shall ensure that staff under their supervision comply with this policy.
3. All staff, volunteers, interns and contractors shall protect personal data, follow approved procedures and report suspected breaches or weaknesses.
4. Data processors and service providers shall comply with applicable contractual and data protection requirements.

FORE shall regularly monitor the implementation and effectiveness of this policy.

1. Compliance may be assessed through internal reviews, access reviews, training records, incident records and other appropriate measures.
2. FORE shall maintain appropriate records demonstrating its data protection practices.
3. This policy shall be reviewed at least annually or whenever there are significant legal, regulatory, technological or operational changes.
4. Enforcement: Failure to comply with this policy may result in disciplinary or contractual action in accordance with FORE's applicable procedures and the law.
5. Depending on the circumstances, consequences may include a warning, withdrawal of access, disciplinary action, termination of employment or contract, and reporting to relevant authorities where required.

Any person who has concerns regarding the collection, use, disclosure or protection of their personal data by FORE may raise the matter with the designated responsible person or the Executive Director. FORE shall consider complaints fairly and take appropriate corrective action where necessary.

FORE is committed to protecting the privacy and confidentiality of the personal information entrusted to it. Staff, volunteers, interns, contractors and other persons authorized to handle FORE information are expected to read, understand and comply with this policy and any related procedures.

Where consent is required, FORE shall obtain consent through an appropriate consent or information notice process rather than relying solely on acknowledgement of this policy.

For questions, concerns, requests or complaints relating to this policy or the handling of personal data, please contact:

Mr. Albert L. Elwa
Executive Director
Email: info@recoveryuganda.org

This policy was reviewed and updated on 7 June 2026.

FORE reserves the right to amend this policy where necessary to reflect changes in applicable law, regulation, organisational practice, technology or data protection requirements. Any material changes shall be communicated through appropriate channels.

Approved by Albert Louis Elwa, Executive Director.