Rwanda
ModerateLaw No. 058/2021 on the Protection of Personal Data and Privacy
Authority: National Cyber Security Authority (NCSA) | Enforcement: partial | Enacted: October 2021
Overview
Rwanda enacted its data protection law in 2021. The NCSA oversees data protection alongside its cybersecurity mandate. The law covers consent, data subject rights, cross-border transfers, and breach notification.
14-Topic Coverage
Data Protection Authority
Fully AddressedNCSA oversees data protection enforcement.
Consent Requirements
Fully AddressedConsent required as primary basis. Must be free, specific, informed, and unambiguous.
Data Subject Rights
Fully AddressedRights to access, rectification, erasure, restriction, portability, and objection.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with appropriate safeguards.
Breach Notification
Fully AddressedMust notify NCSA within 48 hours. Must notify data subjects if high risk.
DPO Requirements
Partially AddressedDPO required for certain categories of controllers.
Children's Data
Partially AddressedParental consent required for children. Age threshold to be defined.
Penalties & Enforcement
Fully AddressedFines from RWF 5 million to RWF 20 million. Criminal penalties for serious violations.
Sector-Specific Rules
Partially AddressedBNR financial data rules, health data regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions.
Data Localisation
Partially AddressedSome government and critical data may require local storage.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedLaw applies to government with national security exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Rwanda's regulations.
Book a Consultation