Uganda's bulk SMS rules sit in one short statutory instrument: the Uganda Communications (Text and Multimedia Messaging) Regulations, 2019 (SI 2019 No. 83), made under the Uganda Communications Act, 2013 and enforced by the Uganda Communications Commission (UCC). In plain terms, you need prior consent for commercial SMS, every message must identify you, STOP must work within 24 hours, and commercial messages should not be timed for delivery between 19:00 and 06:00.
Last reviewed: 27 October 2026. This is a plain-English summary of the published text, not legal advice. For edge cases, ask UCC or a Ugandan lawyer.
Who the regulations apply to
Regulation 2 applies the rules to everyone who originates or terminates text and multimedia messages accessed or initiated by subscribers in Uganda. That covers mobile networks, information and application providers, short code holders and the businesses that send through them (the regulations call these "authorised parties").
Regulation 2(2) lists what is outside scope:
- Messages initiated by Government or a government ministry, department or agency, and messages UCC authorises in an emergency or in the public interest (health, safety, law enforcement).
- Personal messages between people and their family, friends and contacts.
- Closed user group messages from an employer to its staff.
- Any other messages UCC authorises in the public interest.
So a private school, SACCO, clinic, shop or fintech is in scope. An internal shift roster sent by an employer to its own staff is not.
Clause-by-clause checklist
The table below covers every regulation that creates a duty for a business sending SMS. The left column is the regulation number in SI 2019 No. 83.
| Reg. | What it says | What you do |
|---|---|---|
| 5 | No automated system may send unsolicited SMS or MMS to a subscriber. | Only load numbers that agreed to hear from you into a bulk tool or API. |
| 7-8 | No prohibited content, which includes content that is unsolicited, invades privacy, or induces unacceptable fear or anxiety. | Review templates. Debt collection wording that threatens or shames is a risk. |
| 9 | Staff must be made aware of the regulations. | Brief everyone who can press "send". |
| 10(1)-(3) | Pricing must be clear, no misleading information, terms available on request. | State fees and conditions plainly in offers. |
| 10(4)-(5) | Every message carries an accurate identifier, contact information, and the organisation's name. | Use a registered sender ID and name the brand in the text. |
| 10(6) | Identifiers and contact details must stay accurate and available for at least 45 days after sending. | Do not retire a phone line or sender ID the day after a campaign. |
| 10(7) | On request from a validated recipient, say where you got their number within 36 hours. | Record the source of every contact at import. |
| 11(1)-(2) | Prior consent for commercial communication, unless the number came from a prior commercial transaction and you told the person at collection, with a right to object. | Add a marketing notice and opt-out choice to forms and account opening. |
| 11(3) | Messages sent under the existing-customer exception must show an easy way to stop. | Include an opt-out line in promotions. |
| 11(4) | Do not sell or share customer personal information without explicit consent, except where law requires. | No list rental or list sharing. |
| 12 | Free, obvious opt-out based on STOP (END, CANCEL, UNSUBSCRIBE, QUIT count too); confirm it; honour within 24 hours; keep opt-out requests for 12 months. | Run a suppression list and keep its history. |
| 15 | Keep logs of billing, time, date and content of messages. | Keep campaign and delivery reports. The regulation does not set a retention period. |
| 16 | Have a complaints process; acknowledge and respond within 7 days; use channels customers can actually reach. | Publish a phone line or email in messages. |
| 17 | When a network refers a complaint to you, respond to the network within 24 hours. | Name someone who watches for network escalations. |
| 19 | Commercial messages may not be timed for delivery between 19:00 and 06:00 unless agreed or part of the service; health, fire and security emergencies are exempt. | Schedule promotions in the day. |
| 20 | A commercial message is spam unless the recipient consented, or had a direct prior commercial relationship within the last three months obtained under reg 11(2). | Treat lapsed customers as needing fresh consent. |
| 21 | No repeated messages pushing people to call or text a premium-rate number without express consent. | Avoid premium-rate calls to action. |
| 22 | Subscription services send a reminder within 30 days of sign-up and monthly after that, with tariff and how to unsubscribe. | Applies if you run a paid subscription service. |
| 23 | Restricted (18+) content only on request and after reasonable age checks. | Mostly irrelevant for business messaging; alcohol promotions are a grey area to check. |
The five rules that catch most senders
1. Consent and the three-month window
Regulations 11 and 20 work together. If a person bought from you and was told at that moment that you might market to them, with a chance to say no, you can send them commercial SMS. Regulation 20 then defines spam as a commercial message where there was neither consent nor a direct prior commercial relationship within three months. A customer who last bought from you a year ago, and never ticked a marketing box, is a weak basis for a promotion. A short "Would you like offers by SMS? Reply YES" exchange, or a consent tick on a form, fixes that.
2. Identify yourself in every message
Regulation 10(4) and 10(5) require a recognisable identifier and the organisation's name, plus a way to contact you. In practice that means a registered alphanumeric sender ID (see our Uganda sender ID page) and the brand name in the body. A message that says only "Your loan is due" from a random number fails on both counts.
3. STOP must actually work
Regulation 12 is the most operational clause. The opt-out must be based on the word STOP, must be free, and END, CANCEL, UNSUBSCRIBE and QUIT must be treated the same way. You must send a confirmation naming the service the person left, stop within 24 hours, and keep the request for at least 12 months. If someone opts out of one category of products but asks to keep another (for example, keep loan statements, stop promotions), regulation 12(3) lets you honour that split.
A one-way alphanumeric sender ID cannot receive replies, so "reply STOP" needs a two-way number or short code behind it. Options are a two-way SMS short code, a phone number or WhatsApp line people can message, or a short opt-out link. On eSMS Africa, STOP replies to a two-way number are recorded as opt-outs automatically, and sends to numbers on your opt-out list are blocked.
4. The 19:00 to 06:00 limit
Regulation 19 says commercial communications may not be timed to be delivered between 19:00 and 06:00, unless the recipient explicitly agreed or night delivery is part of the service description. Emergency alerts about health, fire or security are exempt. The regulation speaks of commercial communications, so a one-time password or a deposit confirmation the customer triggered is usually treated differently from a promotion. When in doubt, schedule bulk sends for working hours; the eSMS dashboard and API both accept a scheduled send time.
5. Be ready to say where a number came from
Regulation 10(7) gives a validated recipient the right to ask where you obtained their contact details, and you have 36 hours to answer. Regulation 12(8) gives the same person a right to ask their network. If your contact list has no source column, add one now: "branch account opening, 2025", "school admission form", "website sign-up".
Where the Data Protection and Privacy Act fits
The UCC regulations deal with messages. The Data Protection and Privacy Act, 2019 deals with the personal data behind them. Two points matter most for SMS:
- Right to stop direct marketing. Section 26 of the Act lets a person require you to stop using their data for direct marketing. An SMS opt-out should therefore also stop other marketing use of that number.
- Registration. Data collectors, processors and controllers must register with the Personal Data Protection Office (PDPO) under NITA-U, as summarised by DLA Piper. If you hold a customer phone list, assume this applies to you.
The Act also restricts processing children's data without parental consent, which matters for schools messaging parents about pupils.
What happens if you break the rules
Enforcement runs on two tracks. Under regulation 13, a network must give every sender a copy of the regulations, send a written notification for a minor breach and a written warning for a systemic or significant one, and can suspend or terminate your messaging if you do not comply. Under regulation 14, UCC can impose fines, publish compliance or violation status, instruct networks to suspend or terminate contracts with the sender, and order compensation or refunds to affected customers. Regulation 14(4) makes organisations liable for the acts of their employees and agents.
UCC has acted on unsolicited SMS before: in 2015 it fined MTN Uganda about UGX 5 billion over unsolicited messages, as reported by TechCabal.
A compliance checklist you can copy
- Every contact has a consent record or a recent (three-month) customer relationship, and a source.
- Every promotion names the brand, uses a registered sender ID and includes an opt-out route that works.
- Opt-outs are processed within 24 hours, confirmed, and kept for 12 months.
- Promotions are scheduled between 06:00 and 19:00.
- Complaints are acknowledged and answered within 7 days, network referrals within 24 hours.
- Message logs and delivery reports are kept.
- Your organisation is registered with the PDPO.
- Staff who send messages have read this checklist.
Industry pages show how these rules apply to SACCOs and banks, schools and retailers, with compliant sample messages.
Frequently asked questions
Do the UCC regulations apply to OTPs and transaction alerts?
The regulations apply to all originators of SMS, but most of the consent and timing rules target commercial communications. An OTP or a receipt the customer triggered is requested by them, so it is not unsolicited. You still need to identify yourself, keep logs and handle complaints. Keep promotional content out of transactional messages so they stay clearly transactional.
Can I send promotions after 7pm if my customers want them?
Regulation 19 allows delivery between 19:00 and 06:00 where the recipient explicitly agreed, or where night delivery is part of the upfront description of the service. Record that agreement. Without it, schedule commercial messages between 06:00 and 19:00.
How long must I keep message records?
Opt-out requests must be kept for at least 12 months (regulation 12(7)), and sender identifiers and contact details must remain accurate for at least 45 days after a message (regulation 10(6)). Regulation 15 requires logs of billing, time, date and content but does not set a retention period, so follow your own data retention policy and any sector rules.
Are government messages covered?
No. Regulation 2(2)(a) excludes messages initiated by Government or a government ministry, department or agency, and messages UCC authorises for emergencies or the public interest. Private contractors sending on their own behalf are still covered.
Sources
- UCC - Uganda Communications (Text and Multimedia Messaging) Regulations, 2019, SI 2019 No. 83 (PDF)
- Data Protection and Privacy Act, 2019 (ULII)
- DLA Piper - Data protection laws of Uganda
- TechCabal - UCC fines MTN Uganda Shs 5 billion for unsolicited SMS (2015)
eSMS Africa builds these rules into the platform: registered sender IDs, an opt-out list that blocks sends, scheduling and delivery reports. See how it works for your sector on the Uganda use-case hub, or create a free account and send your first test message today.
