# Data Protection Impact Assessment (DPIA) — Cross-Border Hosting

**Conducted by:** Data Protection Officer, AdvocatesConnect (U) Limited  
**Date:** 5 November 2026  
**Version:** 1.0  
**Legal basis:** Data Protection and Privacy Act, 2019, s.19; Data Protection and Privacy Regulations, 2021 (SI 61 of 2021), Regulation 19  
**Related RoPA:** `RoPA-v1.md`

---

## 1. Description of the transfer

The Suites platform is hosted on cloud infrastructure with regions outside Uganda (EU and US). Personal data — including client matter data, payroll data, and account data — is stored on this infrastructure. The hosting provider acts as a sub-processor under Regulation 19 of the Data Protection and Privacy Regulations, 2021.

## 2. Countries and organisations involved

The actual hosting regions and processors are published in the live sub-processor list on the platform (VendorRegister entity, rendered in the platform footer). AdvocatesConnect relies on the following safeguards for each transfer:

- **Contractual clauses** with the hosting provider and each sub-processor, requiring a level of protection comparable to that under Ugandan law;
- **Encryption** of personal data in transit (TLS 1.2+) and at rest (AES-256), so that data transferred to, or held in, the hosting region is not intelligible to the processor without the platform's keys;
- **Data residency controls** where the provider supports region pinning.

## 3. Necessity

Cross-border hosting is necessary for the performance of the platform contract: it provides the availability, durability, and security standards (certified hosting, redundant regions) that Ugandan law firms require for professional records. Hosting solely within Uganda is not currently available at a comparable security and availability standard for a platform of this scale.

## 4. Assessment of risks to data subjects

| Risk | Likelihood | Severity | Risk level |
|---|---|---|---|
| Access to personal data by foreign authorities under non-Ugandan law | Low | High | Medium |
| Provider sub-processor change without notice | Medium | Medium | Medium |
| Data centre outage causing loss of availability | Low | High | Medium |
| Inadequate provider security leading to breach | Low | High | Medium |

## 5. Mitigation measures

- **Sub-processor list and change notice:** The published sub-processor list names each processor and hosting region. AdvocatesConnect commits to at least 14 days' notice before adding or replacing a sub-processor, giving firms the opportunity to object or withdraw data.
- **Contractual safeguards:** DPAs / contractual clauses with each processor require comparable protection to Ugandan law, breach notification, and audit rights.
- **Encryption:** Data is encrypted in transit and at rest, limiting exposure even if the hosting region is accessed.
- **Region disclosure:** The actual regions are named in the footer and Privacy Statement, not described generically as "outside Uganda".
- **Breach commitment:** 72-hour notification to the PDPO under s.23(h) of the Act and Regulation 15.

## 6. Residual risk

Residual risk is assessed as **medium** and is accepted, given the contractual safeguards, encryption, transparency, and the absence of a comparable domestic hosting alternative. The risk will be re-assessed if a Ugandan hosting provider offering comparable security and availability becomes available.

## 7. Conclusion

Cross-border hosting under Regulation 19 safeguards is a proportionate and necessary measure. Firms are informed of the regions and processors and may raise objections through the sub-processor change-notice process. This DPIA will be reviewed when a sub-processor is added or replaced, or when the hosting region changes.

*End of DPIA.*