The Role and Effectiveness of Legal Frameworks in Safeguarding Data Privacy during the Implementation of Central Bank Digital Currency

Central bank digital currency (CBDC) promises faster, cheaper and more inclusive payments, but it carries a distinctive risk: unlike cash, a retail CBDC can make every transaction visible to the issuing authority, placing the right to data privacy at the centre of its design. This article examines the role and effectiveness of the legal frameworks that would safeguard data privacy during the implementation of a CBDC, with particular reference to Uganda, where the Bank of Uganda has indicated that it is studying the feasibility of a digital shilling. It sets out the concept of CBDC and the design choices that determine its privacy profile, the international and regional protection of data privacy, and the Ugandan constitutional and statutory framework, principally article 27 of the Constitution, the Data Protection and Privacy Act 2019 and the National Payment Systems Act 2020. It analyses the specific privacy risks of a CBDC, transaction traceability and surveillance, data concentration, function creep and cyber-insecurity, and assesses how far the existing framework answers them. Drawing on comparative experience with the eNaira, the e-CNY, the digital euro and the Sand Dollar, and on the privacy and data-retention jurisprudence of the European courts, the article argues that Uganda's framework provides a sound foundation of principle but is not adapted to the acute and specific risks of a retail CBDC, is weakened by broad national-security exemptions, and depends on a data-protection regulator of limited capacity. It recommends a privacy-by-design architecture, data minimisation and tiered anonymity, a dedicated legal instrument, strict limits on State access, and a strengthened Personal Data Protection Office.