Intellectual Property, Data & Technology

Four regimes for the knowledge economy

Rwanda markets itself as a technology and services hub, and the law has followed. Four bodies of rules matter to an investor whose value lies in brands, inventions, software, content or data. Intellectual property is governed by Law N° 055/2024 of 20/06/2024 on the protection of intellectual property, which covers every category of right in one statute and is administered in practice by the Rwanda Development Board (RDB). Personal data is governed by Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, supervised by the National Cyber Security Authority (NCSA). Cybersecurity rests on Law N° 26/2017 establishing NCSA and Law N° 60/2018 on cyber crimes, supplemented by sector rules of the National Bank of Rwanda (BNR). Digital commerce is governed by the electronic transactions provisions of Law N° 24/2016 governing ICT and, since March 2026, the e-commerce and consumer rules of Law N° 011/2026, with separate regimes for payments, regulatory sandboxes and, since May 2026, virtual assets.

Article 11 of Law N° 006/2021 of 05/02/2021 on Investment Promotion and Facilitation guarantees investors' intellectual property and technology-transfer rights, as explained in The Investment Code 2021. The statutes in this chapter give that guarantee its content.

Registering and protecting brands, inventions and designs

Exclusive rights over industrial property arise only on registration, and between independent claimants the first to file wins (Articles 253 and 264 of the IP Law). A foreign applicant whose residence or principal place of business is outside Rwanda must act through an authorised Rwandan industrial property agent (Article 251). A trade mark application is examined, published in the Official Gazette within 30 days of examination and open to opposition for 60 days, and a registration lasts 10 years from filing, renewable indefinitely, but may be removed after three years of non-use. Rwanda is bound by the Madrid Protocol, and a designation of Rwanda is deemed accepted if no decision is notified within 12 months. These rules are in The IP law and trade marks.

Patents last 20 years, utility model certificates 10 and registered designs 15. The 2024 law introduced provisional specifications and pre-grant opposition, and RDB's published procedure points applicants to the African Regional Intellectual Property Organization (ARIPO) for substantive examination. Two exclusions stand out: computer programs per se, with an applicant for a computer-implemented invention waiving copyright in the same subject matter, and pharmaceutical products, to be specified by an Order of the health Minister that had not appeared at 10 October 2026. Compulsory licences, the PCT and Harare routes and employee inventions are covered in Patents, utility models and industrial designs.

Copyright, software and enforcement

Copyright arises without registration and lasts for the author's life plus 50 years. Computer programs and original databases are protected; economic rights in works created under a creative employment contract are deemed assigned to the employer and commissioned works belong to the commissioner unless a written contract says otherwise, but assignments and licences must be in writing, signed by both parties and state their territory, or they are presumed limited to the place of signature. Since 9 September 2026 a Ministerial Order has placed broadcasting, public performance and digital uses under state collective management covering non-members, with royalties split 70% to right holders, 20% to administration and 10% to creative-industry promotion. See Copyright, software and digital content.

Enforcement tools are strong on paper: ex parte court orders decided within three working days, destruction of counterfeit goods, damages or an account of profits, an order to name suppliers, customs suspension of counterfeit imports, and criminal penalties of up to five years' imprisonment with fines multiplied by ten for companies. The deadlines are tight, notably 10 working days after a customs notice to show that court proceedings have started, and goods in transit are outside the border measures. The Commercial Court hears IP disputes at first instance. See IP enforcement and anti-counterfeiting.

Licensing, technology transfer and IP holding

Patent and trade mark assignments and licences become valid and enforceable only once recorded with RDB, which may refuse to record them if they contain anti-competitive clauses such as no-challenge terms, exclusive grant-backs, tying or export bans. The new competition law adds rules on vertical agreements and on the use of intellectual property to foreclose markets. Rwanda has no franchise statute, so franchising rests on contract law and the trade mark licence rules; trade secrets are protected as a form of unfair competition. On the tax side, the Investment Code offers a 3% corporate income tax rate on foreign-sourced royalties to a registered investor operating as an intellectual property company that meets substance conditions, and royalties it pays are exempt from withholding tax. See Technology transfer, franchising and licensing and Investment incentives.

Personal data and cybersecurity

Law N° 058/2021 applies to controllers and processors in Rwanda and to those abroad who process the data of people located in Rwanda. Every controller and processor must register with NCSA, which issues a certificate within 30 working days and charges no fee; every company in practice needs a data protection officer; and a non-resident must appoint a representative in Rwanda. Personal data must be stored in Rwanda unless the registration certificate authorises storage abroad, and transfers abroad need an NCSA authorisation with safeguards or another statutory ground. Breaches must be reported to NCSA within 48 hours and fully within 72. Administrative fines run from RWF 2 million to RWF 5 million or 1% of global turnover, and criminal fines on companies reach 5% of annual turnover. See Personal data protection.

NCSA sets minimum cybersecurity standards for public institutions, the financial sector and essential service providers, and Law N° 60/2018 requires service providers to report immediately when their systems are used to commit an offence and punishes companies with fines of 30% to 70% of the year's profits. Banks and other BNR-regulated institutions must notify BNR of a cyber incident within two hours. The Presidential Order designating critical information infrastructure had not been located. See Cybersecurity and critical information.

E-commerce, fintech and AI

Electronic records, contracts and signatures are recognised under Law N° 24/2016. Since 4 March 2026 Law N° 011/2026 has required e-commerce operators and online intermediaries to be licensed by the Rwanda Inspectorate, Competition and Consumer Protection Authority (RICA), to show their identity, registration number and a physical address in Rwanda, and to give consumers seven days to withdraw from an online purchase, with refunds within 15 days. A 1.5% digital services tax has been enacted but awaits its implementing order. Payment service providers are licensed by BNR in four categories with capital from RWF 30 million to RWF 300 million, BNR's sandbox allows testing for up to 12 months, extendable by up to 12 more, and the Capital Market Authority (CMA) licenses virtual asset service providers under the May 2026 law. Rwanda has a National AI Policy, and Cabinet approved a National Artificial Intelligence Agency in June 2026, but there is no AI statute; the data protection rules on automated decisions and impact assessments apply. See E-commerce, fintech and AI.

How to use this chapter

Start with what the business owns. Brand owners should read The IP law and trade marks before launch; technology and manufacturing businesses Patents, utility models and industrial designs; software, media and venue operators Copyright, software and digital content; and anyone facing copies or counterfeits IP enforcement and anti-counterfeiting. Groups licensing rights into Rwanda or holding IP there should continue with Technology transfer, franchising and licensing. Every business that holds customer or employee data should read Personal data protection and Cybersecurity and critical information, and online sellers, payment firms and AI developers E-commerce, fintech and AI.

Each section ends with the Be Rwanda Wise FAQs on the subject, the official sources and a question you can put to Rwandabot, the AI legal-information chatbot, about your own facts. The guide states the law at 10 October 2026. Much of this field is moving: new IP fee, agent and appeal orders (Cabinet approved a Ministerial Order on industrial property fees and customs security on 4 March 2026, but it had not been located in the Official Gazette), the health Minister's pharmaceutical order, collective management tariffs, RICA's e-commerce regulations, the digital services tax order, NCSA regulations and the virtual asset regulations were all awaited. Check the position again before relying on it in 2027, and take advice from a Rwandan advocate or authorised IP agent on any filing or dispute.