Data Protection Law in Rwanda: What Businesses Must Do to Comply with Law Nº 058/2021

The data protection law in Rwanda is no longer a future compliance project: the two-year transitional period for existing businesses has ended, and the regulator now registers organisations, authorises international transfers and receives breach reports. This guide sets out what the law requires, who it applies to, what non-compliance can cost and the steps to take now. For hands-on support, our data protection and cybersecurity team advises organisations across every sector.

What Is the Data Protection Law in Rwanda?

The governing statute is Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, published in the Official Gazette special issue of 15 October 2021. It came into force on the date of publication. Businesses that were already operating had a period not exceeding two years from publication to bring their operations into line, so that grace period is now over.

The law names the "supervisory authority" as the public authority in charge of cyber security. In practice, this is the National Cyber Security Authority (NCSA), which supervises the law through its Data Protection and Privacy Office (DPO).

Who Does the Law Apply To?

The law applies to any processing of personal data, whether automated or not, by a data controller, data processor or third party that:

• is established or resides in Rwanda and processes personal data while in Rwanda; or
• is neither established nor resident in Rwanda but processes personal data of data subjects located in Rwanda.

A company with no Rwandan office can therefore still be caught if it serves customers in Rwanda, and must designate a representative in Rwanda in writing.

Personal Data and Sensitive Personal Data

Personal data means any information relating to an identified or identifiable natural person, such as a name, identification number, location data or online identifier. Sensitive personal data, which includes information revealing health status, criminal records, religious beliefs, political opinion or genetic data, carries stricter conditions and the heaviest criminal penalties.

Core Obligations for Data Controllers and Processors

Registration With the NCSA

Anyone who intends to act as a data controller or data processor must register with the supervisory authority. The application must describe, among other things, the personal data to be processed, the categories of data subjects, the purposes of processing, the recipients, any country to which data will be transferred, and the risks involved together with the measures to address them. The authority issues a certificate to a qualifying applicant within 30 working days of receiving the application. The DPO registration guide and application forms are published online.

Registration is not a one-off exercise: changes must be notified within 15 working days, and renewal may be sought within 45 working days before expiry.

Lawful Basis, Transparency and Records

Processing is lawful only where it rests on one of the grounds listed in the law, including consent, performance of a contract, a legal obligation, vital interests, a public-interest task, legitimate interests and authorised research. When collecting data, the controller must tell individuals, among other things, why it is collected, who receives it, how long it is kept and what rights they have.

Controllers and processors must also keep a record of all processing activities, implement appropriate technical and organisational security measures, and carry out a data protection impact assessment (DPIA) where processing is likely to result in a high risk. Triggers include large-scale processing of sensitive data, automated profiling and new technologies, which is directly relevant to businesses deploying analytics or AI and data centre infrastructure.

Data Protection Officer

A data protection officer must be designated in several cases, including where processing is carried out by a public or private corporate body or legal entity (courts excepted). On a plain reading, this captures most companies. The officer may be an employee or an external provider, and their contact details must be published and sent to the authority. The DPO publishes a designation guide to support this step.

Data Subject Rights Businesses Must Honour

The law gives individuals a defined set of rights, exercisable in writing or electronically:

• Access: information on the purposes of processing, a copy of their data, its source and whether it has been transferred abroad.
• Objection: including an unconditional right to stop processing for direct marketing.
• Portability: receiving their data in a structured, readable format or having it sent to another controller.
• Restriction, rectification and erasure, subject to listed exceptions.
• Not being subject to decisions based solely on automated processing, including profiling, with limited exceptions.
• Designating an heir to their personal data and representation, for example for children under 16.

For most rights, the controller must respond within 30 days of the request. An individual who is dissatisfied may appeal to the supervisory authority within 30 days, and the authority responds within 60 days. HR, customer service and marketing teams therefore need a documented process. Employers should align this with their employment contracts and staff policies, since employee records are personal data too.

Cross-Border Transfers, Storage and Breach Notification

Transfers and Storage Outside Rwanda

The default rule is that personal data is stored in Rwanda. Storage outside Rwanda is permitted only where the controller or processor holds a valid registration certificate authorising it. Transfers to a third party abroad are allowed on specified grounds, including authorisation from the supervisory authority after proof of appropriate safeguards, the individual's consent, or necessity for a contract or a legal claim. A written contract must set out each party's responsibilities, and the authority may suspend or prohibit transfers.

Businesses using foreign cloud hosting or group HR systems should review the DPO's transfer authorisation service and build these terms into their commercial contracts. For the wider policy context, see our analysis of cross-border data flows in Africa.

Personal Data Breaches

The breach timetable is tight and often misstated:

• The data controller must communicate a personal data breach to the supervisory authority within 48 hours of becoming aware of it.
• A data processor must notify the controller within 48 hours of becoming aware of it.
• The controller must then submit a breach report to the authority not later than 72 hours, covering the nature of the breach, the people and records affected, the measures taken and a proposal for informing affected individuals.
• Where a breach is likely to result in a high risk to individuals, the controller must also inform them, unless a statutory exception applies.

The DPO runs a channel to report a data breach. A plan naming decision-makers in advance is essential to meet these deadlines.

Penalties Under the Data Protection Law in Rwanda

Administrative misconduct. Failures such as not keeping processing records, operating without a registration certificate, using an expired certificate, failing to designate a data protection officer, or failing to notify or report a breach attract an administrative fine of not less than RWF 2,000,000 and not more than RWF 5,000,000, or 1% of global turnover for the preceding financial year. For a corporate body or legal entity, the law provides for 1% of global turnover of the preceding financial year.

Criminal offences. Unlawfully accessing, collecting, using, sharing or disclosing personal data is punishable by one to three years' imprisonment and a fine of RWF 7,000,000 to RWF 10,000,000, or one of these penalties. Unlawful sale of data and unlawful processing of sensitive data carry heavier sentences. A convicted corporate body faces a fine of 5% of its annual turnover for the previous financial year, and individuals who suffer serious damage may claim compensation in court.

A Practical Compliance Checklist

• Map your data: what you hold, where it sits and where it travels.
• Confirm your role and register as controller, processor or both, and diarise renewal.
• Appoint a data protection officer and notify the authority of their details.
• Update notices and consents on websites, apps, forms and employee documents.
• Build a records register and DPIA process for high-risk projects.
• Secure transfer and storage authorisations and sign written transfer contracts with vendors.
• Test a breach response plan against the 48-hour and 72-hour deadlines.
• Protect related assets: customer databases and software often also need protection under intellectual property law in Rwanda.
• Put governance in place: report data risk to the board as part of sound corporate governance, and include data protection in due diligence for acquisitions and international investment.

Frequently Asked Questions

What is the data protection law in Rwanda called?

It is Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. It came into force on publication in the Official Gazette on 15 October 2021, and the two-year transitional period for existing businesses has ended.

Who regulates data protection in Rwanda?

The National Cyber Security Authority (NCSA) supervises the law through its Data Protection and Privacy Office. It registers controllers and processors, authorises transfers abroad, handles complaints and imposes administrative sanctions.

Do foreign companies need to register with the NCSA?

The law applies to controllers and processors outside Rwanda that process personal data of people located in Rwanda. Such businesses must also designate a representative in Rwanda in writing. Foreign companies serving Rwandan customers should therefore assess whether they need to register.

How quickly must a data breach be reported in Rwanda?

The data controller must notify the supervisory authority within 48 hours of becoming aware of a breach, and a processor must notify the controller within the same period. A full breach report must follow not later than 72 hours. High-risk breaches must also be communicated to affected individuals.

Can personal data be stored outside Rwanda?

Yes, but only if the controller or processor holds a valid registration certificate authorising storage outside Rwanda. Transfers to third parties abroad must also meet one of the grounds in the law and be covered by a written contract.

Conclusion

Compliance with the data protection law in Rwanda is now an operational requirement, with real administrative and criminal exposure for businesses that delay. The best-placed organisations register, appoint a data protection officer, document their processing and rehearse breach response before an incident.

WAYAN's data protection and cybersecurity lawyers in Rwanda can assess your position, manage your NCSA registration and authorisations, and build a compliance programme that fits your business. Book a consultation with WAYAN to get started.