English
አማርኛ
Français
Kinyarwanda
हिन्दी
中文
Türkçe
Deutsch
日本語
Nederlands
العربية
Русский
PortuguêsData Protection & Cybersecurity
Helping organisations protect personal data and comply with Rwandan law.
About WAYAN
Expert legal and strategic advisory in Rwanda
WAYAN is a leading law firm in Rwanda providing expert legal and strategic advisory services in Financial Services, Government Strategic Investment Projects, Artificial Intelligence & Data Centres, Data Protection & Cybersecurity, Intellectual Property, Strategic Advisory & Management Consulting, Corporate Governance, Alternative Dispute Resolution, and Pro Bono. We help businesses, government institutions, and organisations navigate complex legal and regulatory challenges with confidence, delivering practical solutions tailored to their needs.
What We Do
Data Protection & Cybersecurity Services
- 01
Registration and regulatory compliance
- Registering data controllers and processors with the National Cyber Security Authority (NCSA), and renewing their certificates.
- Compliance assessments (gap analyses) against Law No. 058/2021, and compliance roadmaps.
- 02
Data protection audits and data mapping
- Reviewing what personal data the organisation holds, where it flows, and the legal basis for each use.
- Maintaining records of processing activities.
- 03
Policies, notices and governance
- Drafting privacy policies, privacy notices, consent forms, data retention policies and internal data protection policies.
- Board-level data governance frameworks.
- 04
Data protection impact assessments (DPIAs)
- DPIAs for high-risk processing, such as biometrics, health data, large-scale monitoring and AI systems.
- 05
Cross-border data transfers and storage
- Obtaining NCSA authorisation to store or transfer personal data outside Rwanda.
- Data transfer agreements and advice on cloud and foreign-hosted services.
- 06
Data protection officer (DPO) support
- An outsourced DPO service, or ongoing support for in-house DPOs, including liaison with NCSA.
- 07
Data subject rights management
- Procedures for handling individuals’ requests for access, correction, erasure and objection.
- 08
Contracts and vendor management
- Data processing agreements, data sharing agreements, and data protection clauses in outsourcing, IT and cloud contracts.
- Due diligence on vendors that process data for the client.
- 09
Data breach and cyber incident response
- Breach response plans before an incident happens.
- During and after an incident: notifying NCSA and affected individuals, coordinating forensic investigations, and managing reputational risk.
- Advice under Rwanda’s cybercrime legislation.
- 10
Regulatory investigations and disputes
- Representing clients in NCSA inspections, investigations and complaints.
- Data-related disputes.
- 11
Data protection in transactions
- Data protection due diligence in mergers, acquisitions and investments.
- Data issues in financings, joint ventures and outsourcing.
- 12
Sector-specific advice
- Financial services and fintech, including National Bank of Rwanda requirements.
- Health, telecoms, e-commerce and the public sector.
- 13
Marketing and digital compliance
- Consent for direct marketing, cookies and online tracking, and customer databases.
- 14
Training and awareness
- Staff and board training on data protection obligations and cybersecurity good practice.
WAYAN Law Firm
Helping organisations protect personal data and comply with Rwandan law.
Read our perspective on cross-border data flows in Africa in our News & Insights.
Speak to WAYAN
Data Protection & Cybersecurity
We help businesses, government institutions, and organisations navigate complex legal and regulatory challenges with confidence, delivering practical solutions tailored to their needs.