Chapter 7 · Section 7.7 of 8

Cybersecurity and critical information infrastructure: the National Cyber Security Authority under Law N° 26/2017, service providers' duties to report, preserve data and take down illegal content under Law N° 60/2018 on cyber crimes, the NCSA minimum standards for essential service providers, BNR's two-hour incident rule for financial institutions, and corporate fines of 30% to 70% of profits

Reviewed 10 October 2026 · Prepared by a commercial lawyer with over 30 years' international experience · Legal and tax information, not legal advice · How we check · Open in the app

Download chapter 7 as a PDF

What you need to know

The National Cyber Security Authority (NCSA), established by Law N° 26/2017 of 31/05/2017 and supervised by the Office of the President (Article 5), sets cybersecurity guidelines and standards for public and private institutions, may audit critical information infrastructure, systems and networks, and investigates cyber threats (Article 10); critical information infrastructure is to be determined by a Presidential Order (Article 11).
Law N° 60/2018 of 22/8/2018 on prevention and punishment of cyber crimes applies to offences committed in Rwanda and to offences committed abroad that produce effects in Rwanda (Article 2), and requires a service provider aware that its systems are used to commit an offence to report immediately to the cyber security authority and preserve traffic information (Article 5).
A service provider informed by security organs of illegal or harmful information must remove it, suspend or terminate the service and assist investigators (Article 6 of Law N° 60/2018), and failing to act on a take-down notification is punishable by a fine of RWF 1,000,000 to RWF 3,000,000 (Article 50).
A business entity convicted of an offence under Law N° 60/2018 is liable to a fine of 30% to 70% of the profits of the accounting period in which the offence was committed (Article 51), and interference with data in critical national information infrastructure carries 10 to 15 years' imprisonment and a fine of RWF 10,000,000 to RWF 30,000,000 (Article 24).
The NCSA's Minimum Cybersecurity Standards for Essential Service Providers, version 1.0 of 28 July 2023, gave essential service providers one year to comply, make Tier 1 controls mandatory for all of them and Tier 2 controls mandatory for those serving at least one million users, and institutions regulated by the National Bank of Rwanda (BNR) notify BNR of cyber incidents within two hours under Regulation N° 50/2022 of 02/06/2022.

The framework: three laws, standards and sector rules

Rwanda's cybersecurity rules are built on three statutes. Law N° 26/2017 of 31/05/2017 establishing the National Cyber Security Authority and determining its mission, organisation and functioning (the NCSA Law) creates the regulator. Law N° 60/2018 of 22/8/2018 on prevention and punishment of cyber crimes (the Cyber Crimes Law), published in the Official Gazette n° Special of 25/09/2018, imposes duties on service providers, provides for the protection of critical information infrastructure and defines the offences. Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy adds security, breach notification and storage duties wherever personal data is involved (Personal data protection). Below the statutes sit NCSA standards and directives, and sector rules from BNR, the Capital Market Authority (CMA) and the Rwanda Utilities Regulatory Authority (RURA).

There is no single cybersecurity licence or registration for ordinary businesses. What an investor must do depends on what it is: every business that processes personal data has data security and breach duties; every service provider, a term the Cyber Crimes Law defines broadly to include any entity that provides services by means of a computer system or processes or stores computer data on behalf of users (Article 3), has reporting and take-down duties; an essential service provider must meet the NCSA's minimum standards; a BNR-regulated institution must meet BNR's cyber security and outsourcing regulations; and an operator of critical information infrastructure will face the rules of a Presidential Order once it is adopted. The United States Department of State's 2026 Investment Climate Statement notes that foreign IT providers are not required to hand over source code or encryption technology.

The National Cyber Security Authority and its powers

The NCSA is placed under the Office of the President of the Republic (Article 5 of the NCSA Law) and enjoys administrative and financial autonomy (Article 8). Its responsibilities include advising public and private institutions on defending Rwanda's interests in cyberspace, conducting cyber intelligence, setting guidelines based on national, regional and international ICT security principles, coordinating national ICT security policy and preventing cyber-attacks on ICT infrastructure in general and critical information infrastructure in particular (Article 9). Its powers, in Article 10, are to set guidelines and standards for cyberspace protection and ICT security within public and private institutions; to carry out audits of critical information infrastructure, cyber systems and networks within public and private institutions where necessary to preserve national security and the public interest; to investigate cyber threats and take preventive action; to conduct cyber security operations; and to establish mechanisms for sharing information on threats and attacks.

The NCSA operates the national computer security incident response team, Rw-CSIRT, which receives incident reports through the NCSA's online form, and since 2021 it has also been the supervisory authority for personal data through its Data Protection and Privacy Office. A single regulator for cybersecurity and data protection means that a serious incident involving personal data is reported to the same authority under two laws, on two timetables. The NCSA's National Cybersecurity Strategy 2024-2029 sets out its programme, including the identification of national critical information infrastructure and essential services.

Duties of service providers under the Cyber Crimes Law

The Cyber Crimes Law reaches beyond Rwanda's borders: it applies to all cyber crimes committed in Rwanda, and to those committed outside Rwanda if they produce effects in Rwanda (Article 2). Its prevention chapter places four groups of duties on service providers. An electronic communications service provider must take reasonable steps to inform clients of cybercrime trends that may affect them, establish procedures for clients to report cybercrimes, tell clients how to protect themselves, and disclose abuses to the victim and to the cyber security organ (Article 4).

Any service provider that is aware or informed that its computer, system or network is being used to commit an offence must immediately report it to the authority in charge of cyber security and preserve any information that may assist the investigation, in particular information showing the communication's origin, destination, route, time, date, size, duration and type of underlying service (Article 5). A service provider informed by security organs or the cyber-security organ of illegal or harmful information or activity must remove the information, suspend or terminate the service concerned and give investigators the information they request (Article 6). Failing to act on a take-down notification about data or activity infringing the rights of the recipient or a third party, or about unlawful material, is an offence punishable by a fine of RWF 1,000,000 to RWF 3,000,000 (Article 50).

These duties are not limited to telecommunications operators. A cloud provider, a hosting company, a software-as-a-service platform, a marketplace or a corporate network that stores data for users can be a service provider within Article 3, and an online intermediary also has a removal duty under Article 46 of Law N° 011/2026 of 26/02/2026 relating to competition and consumer protection once it has actual knowledge of unlawful information (E-commerce, fintech and AI). Platforms should therefore have a documented take-down process, a log of notices and a preservation procedure that can be triggered without waiting for a court order.

Critical information infrastructure

Critical information infrastructure means virtual and physical information systems that provide services to citizens and serve as the backbone of the national economic, social and security life (Article 3 of the Cyber Crimes Law). Article 11 of the NCSA Law and Article 7 of the Cyber Crimes Law leave its identification and protection to a Presidential Order, which is to prescribe minimum standards on protection and preservation, general management, access to and transfer and control of data, integrity and authenticity, storage and archiving, data recovery plans, audits and inspections at any time, and other matters needed to protect critical data and resources.

No such Presidential Order had been located at 10 October 2026, and the National Cybersecurity Strategy 2024-2029 still lists the identification of national critical information infrastructure and essential services as work to be done. Until the Order is adopted, an operator cannot be formally designated, but the statutory consequences of an attack are already severe: interfering with computer data stored in critical national information infrastructure carries 10 to 15 years' imprisonment and a fine of RWF 10,000,000 to RWF 30,000,000 (Article 24). Investors in energy, telecommunications, water, transport, health, finance and government technology contracts should expect to be designated and should design systems that can meet the access, storage, recovery and audit rules the Order will set.

Minimum standards for essential service providers

The NCSA has issued minimum cybersecurity standards for public institutions, for the financial sector and for essential service providers, together with directives on software and networks, all published on its documentation page. The Minimum Cybersecurity Standards for Essential Service Providers, version 1.0 dated 28 July 2023 and issued under the NCSA Law, define an essential service provider (ESP) as an authorised or licensed entity that provides an essential service to the public, businesses or other organisations where the service depends on network and information systems and an incident would have significant disruptive effects. ESPs were to comply within one year of publication, and the standard is to be reviewed at least every four years.

The standard works in three tiers. Tier 1, basic requirements, is mandatory for all ESPs. Tier 2, industry-standard requirements, is mandatory for an ESP that provides a service to at least one million unique users or beneficiaries. Tier 3, advanced requirements, is for ESPs processing critical information whose failure could severely affect the nation. The tier is chosen after a risk assessment, but the NCSA may determine an institution's category with the competent authorities. Its eighteen control families run from security policy, access control, training, audit and accountability and identity management to incident response, risk and security assessment, protection of personal information, contingency planning and supply chain risk management, and it recommends source-code escrow for critical software. An ESP may waive a requirement that is impossible to implement or does not apply after risk assessment, but the waiver must be justified, documented, approved by top management and communicated to the NCSA. The standard expects Rw-CSIRT to be notified of every incident likely to have a significant impact on public health or safety, wide-scale critical services, socio-economic stability or national security.

Financial institutions, payment providers and outsourcing

The financial sector has the most detailed rules. Regulation N° 50/2022 of 02/06/2022 of the National Bank of Rwanda (BNR) on cyber security in regulated institutions requires an institution to notify BNR of a cyber incident within two hours and to submit a full report within 24 hours. Regulation N° 49/2022 of 02/06/2022 on outsourcing allows outsourcing outside Rwanda only where BNR's access to data and systems is not impeded (Article 18) and sets rules for cloud services (Article 20). Payment service providers licensed under Regulation N° 74/2023 of 18/09/2023 must comply with the cybersecurity and business continuity regulations, take account of international standards and maintain a business continuity programme with impact analysis, recovery strategies and alternative sites (Article 54), protect payment and personal data in line with the data protection law (Article 52) and follow the outsourcing regulation (Article 44); their licence applications include a security policy describing systems, data flows and controls.

For a bank, insurer, microfinance institution or payment provider, a single incident can therefore trigger three clocks: two hours to BNR, 48 hours to the NCSA for any personal data breach under Law N° 058/2021 and the immediate report under Article 5 of the Cyber Crimes Law if its systems are being used to commit an offence. Licensing and the wider regulatory framework are described in The financial system and regulators and Payments, currency and mobile money.

Who reports what, to whom and when

Event	Who reports	To whom and when	Source
Systems used to commit an offence	Any service provider	Cyber security authority, immediately; preserve traffic information	Article 5, Law N° 60/2018
Abuses affecting clients	Electronic communications service provider	The victim and the cyber security organ	Article 4, Law N° 60/2018
Notice of illegal or harmful content	Service provider	Remove, suspend or terminate and assist investigators; failure fined RWF 1,000,000 to RWF 3,000,000	Articles 6 and 50, Law N° 60/2018
Personal data breach	Controller (processor to controller)	NCSA within 48 hours; report within 72 hours; individuals if high risk	Articles 43 to 45, Law N° 058/2021
Cyber incident at a regulated financial institution	Bank, insurer, microfinance institution, payment provider	BNR within 2 hours; full report within 24 hours	BNR Regulation N° 50/2022
Incident with significant national impact	Essential service provider	Rw-CSIRT	NCSA ESP Standard v1.0 (2023)
Unlawful content on an e-commerce platform	Online intermediary with actual knowledge	Remove as soon as reasonably practicable; RICA or court may order removal	Article 46, Law N° 011/2026

Offences and penalties

The Cyber Crimes Law defines a wide range of offences. Intentional and unlawful access to computer or system data without consent or entitlement is punishable by six months to two years and a fine of RWF 1,000,000 to RWF 2,000,000 (Article 16). Altering, hindering or interfering with a computer, system or network, including by introducing malicious code, carries two to five years and RWF 1,000,000 to RWF 2,000,000, rising to five to seven years and RWF 3,000,000 to RWF 5,000,000 for data of a state security organ and to ten to fifteen years and RWF 10,000,000 to RWF 30,000,000 for critical national information infrastructure (Article 24). Cyber-squatting carries one to two years and RWF 1,000,000 to RWF 3,000,000 (Article 27), phishing one to two years and RWF 1,000,000 to RWF 3,000,000 (Article 36) and spamming three to six months (Article 37).

For companies the decisive provision is Article 51: a business entity convicted of any offence under the Law is liable to a fine equal to 30% to 70% of the profits received in the accounting period of the year in which the offence was committed. Under Article 52 the court may also confiscate the computers, software and media used and the proceeds, and order the temporary or permanent closure of the premises or corporate body if the offence was committed with the knowledge of the owner or management. These sanctions sit alongside the data protection fines of 1% of global turnover for administrative misconduct and 5% of annual turnover for corporate offences under Law N° 058/2021, so an incident handled carelessly can expose a company under both laws.

Responding to a cyber incident in Rwanda, step by step

Contain and start the clockIsolate affected systems and record the time the business became aware of the incident; the BNR, NCSA and data protection deadlines run from awareness, not from the end of the investigation.
Notify BNR within two hoursIf the entity is a BNR-regulated institution, send the initial notice within two hours and the full report within 24 hours under Regulation N° 50/2022.
Report and preserveIf the systems are being used to commit an offence, report immediately to the NCSA and preserve origin, destination, route, time, size and duration information (Article 5 of Law N° 60/2018); essential service providers also alert Rw-CSIRT.
Assess personal dataDecide whether personal data was affected; if so, the controller notifies the NCSA within 48 hours and processors notify their controllers within the same period (Article 43 of Law N° 058/2021).
File the 72-hour reportSubmit the breach report with the facts available, the measures taken and a proposal for informing data subjects, for NCSA approval (Article 44).
Inform affected peopleWhere the risk to individuals is high, communicate the breach to them in writing or electronically, unless an Article 45 exception applies.
Close outRecord lessons learned, update the risk assessment and controls, and report to the board; keep the file for any NCSA or BNR inspection.

Cyber readiness checklist for an investor's Rwandan operation

What a regulator, auditor or acquirer is likely to ask to see.

Regulatory mapA note of whether the entity is a service provider, an essential service provider, a BNR- or CMA-regulated institution or a likely critical information infrastructure operator, and which rules follow.
Incident response planA plan with the Rwandan clocks built in: immediate report under Article 5, two hours to BNR where applicable, 48 and 72 hours to the NCSA for personal data, and Rw-CSIRT contacts.
Take-down and preservation procedureA log of notices, named responders, and a method to preserve origin, destination, route, time, size and duration data without delay.
ESP tier assessmentA documented risk assessment choosing the tier under the NCSA standard, with any waivers approved by top management and communicated to the NCSA.
Outsourcing and cloud fileContracts giving BNR (for financial institutions) and the NCSA access, the NCSA certificate authorising storage abroad, and exit and escrow arrangements.
Business continuity evidenceBusiness impact analysis, recovery strategies and tested recovery sites, as Article 54 of Regulation N° 74/2023 requires of payment providers.
Board reportingMinutes showing management approval of the security policy and review of incidents, which supports a defence against corporate liability.

Worked example

A ransomware attack on a Kigali payment provider

A Category II payment service provider licensed by BNR detects ransomware on its servers at 22:00 on Friday 6 November 2026; customer names and phone numbers may have been copied. Its profit for the year is RWF 600,000,000 and its global turnover RWF 4,000,000,000. Figures are illustrative.

BNR notice	Due by 00:00 on Saturday 7 November (two hours), with the full report by 22:00 on Saturday 7 November (24 hours), under BNR Regulation N° 50/2022.
NCSA notice of the personal data breach	Due by 22:00 on Sunday 8 November (48 hours), with the report by 22:00 on Monday 9 November (72 hours), including a plan for informing customers.
Rw-CSIRT and evidence	Report the attack to Rw-CSIRT and preserve logs and traffic information for investigators, consistent with Article 5 of Law N° 60/2018.
Customer communication	Because the stolen data enables phishing, the risk is high, so customers are told in writing or electronically under Article 45 of Law N° 058/2021.
Exposure if the breach is not notified	Administrative fine for a corporate body of 1% of global turnover: 1% x RWF 4,000,000,000 = RWF 40,000,000 (Article 53 of Law N° 058/2021).
Exposure if the company itself were convicted of a cyber offence	30% to 70% of the year's profit: RWF 180,000,000 to RWF 420,000,000 (Article 51 of Law N° 60/2018), with possible confiscation and closure.

The victim of an attack is not itself guilty of the attacker's offence; the corporate exposure arises from its own failures, such as not acting on a take-down notice or not notifying a breach.

BNR may also take supervisory action under the payment services regulation.

Questions investors ask

Who regulates cybersecurity in Rwanda?

The National Cyber Security Authority (NCSA), established by Law N° 26/2017 and supervised by the Office of the President. It sets standards for public and private institutions, audits critical information infrastructure, runs Rw-CSIRT and supervises data protection. BNR adds cyber rules for banks, insurers and payment providers, and RURA and the CMA regulate their own sectors.

Must a company report a cyber attack in Rwanda?

It depends on the facts. A service provider aware that its systems are used to commit an offence must report immediately to the cyber security authority (Article 5 of Law N° 60/2018). A personal data breach goes to the NCSA within 48 hours. BNR-regulated institutions notify BNR within two hours, and essential service providers report significant incidents to Rw-CSIRT.

What is critical information infrastructure in Rwanda?

Virtual and physical information systems that provide services to citizens and serve as the backbone of national economic, social and security life (Article 3 of Law N° 60/2018). A Presidential Order is to identify it and set protection rules (Article 7), but none had been located by 10 October 2026. Attacks on it carry 10 to 15 years' imprisonment.

What are the penalties for companies under Rwanda's cyber crimes law?

A business entity convicted of any offence under Law N° 60/2018 is fined 30% to 70% of the profits of the year in which the offence was committed (Article 51). The court may also confiscate equipment and proceeds and close the premises or company if management knew of the offence (Article 52). Failing to act on a take-down notice also carries a fine of RWF 1,000,000 to RWF 3,000,000.

Do the NCSA's essential service provider standards apply to my company?

They apply to an authorised or licensed entity providing an essential service that depends on network and information systems, where an incident would have significant disruptive effects. Tier 1 controls are mandatory for all such providers, Tier 2 for those serving at least one million users, and the NCSA can determine the category with sector regulators.

Can a Rwandan bank or payment provider use a foreign cloud?

Yes, within limits. BNR Regulation N° 49/2022 allows outsourcing outside Rwanda only where BNR's access is not impeded and sets cloud rules, and any personal data stored abroad needs an NCSA certificate authorising storage outside Rwanda under Article 50 of Law N° 058/2021. Payment providers must also meet the business continuity rules in Regulation N° 74/2023.

The 2027 horizon

The Presidential Order identifying critical information infrastructure and setting its protection rules, provided for by Article 11 of Law N° 26/2017 and Article 7 of Law N° 60/2018, had not been located at 10 October 2026; the National Cybersecurity Strategy 2024-2029 commits to identifying critical infrastructure and essential services, so designation of operators is likely during the strategy period.
The ESP standard of 28 July 2023 is to be reviewed at least every four years, so a revised version can be expected by mid-2027; essential service providers should watch the NCSA documentation page.
The NCSA's October 2026 awareness campaign and its 2026 accountability theme suggest closer supervision of registered entities and essential service providers in 2027, although no administrative fines or prosecutions of companies had been published by 10 October 2026.
Law N° 033/2026 of 24/07/2026 governing the National Bank of Rwanda replaced BNR's 2017 statute; BNR's 2022 cyber security and outsourcing regulations, made under the earlier law, remain listed as current, and institutions should watch for replacement instruments.

Terms you will meet in the documents

English	Kinyarwanda	French	Meaning
Critical information infrastructure	Ibikorwaremezo by'ikoranabuhanga byihariye	Infrastructure d'information critique	Information systems that serve as the backbone of national economic, social and security life, to be identified by Presidential Order.
National Cyber Security Authority (NCSA)	Urwego rw'Igihugu rushinzwe Umutekano w'Ibijyanye n'Ikoranabuhanga mu Itangazabumenyi n'Itumanaho	—	The cybersecurity and data protection regulator under Law N° 26/2017.
Cyber crimes	Ibyaha bikoreshejwe ikoranabuhanga	Cybercriminalité	Offences defined by Law N° 60/2018, which applies to offences abroad with effects in Rwanda.
Service provider	—	Fournisseur de services	A public or private entity or individual providing services by means of a computer system, or processing or storing computer data for users (Article 3).
Unauthorised access	—	Accès non autorisé	Intentional, unlawful access to computer or system data, punishable under Article 16.
Cybersecurity	—	Cybersécurité	Protection of computer systems from theft, damage or disruption; the subject of NCSA standards and Article 54 of Regulation N° 74/2023.
Cyber-squatting	—	Cyber-squattage	Acquiring a domain name in bad faith to profit, mislead or harm reputation where it is similar to a registered mark or another's name, punishable under Article 27.
Phishing	—	Phishing	Using a website or electronic message to obtain confidential information for unlawful purposes, punishable under Article 36.

Foreign v Rwandan investor

The cybersecurity rules apply to activities and systems, not to the nationality of their owners, so a foreign-owned service provider in Rwanda has the same duties as a Rwandan one. The reach abroad is wider than many investors expect: Article 2 of Law N° 60/2018 covers offences committed outside Rwanda that produce effects in Rwanda, and a foreign platform storing data for Rwandan users may be a service provider asked to remove content or preserve data. The practical differences are in hosting and access. A foreign group that runs its Rwandan operation's systems from abroad must reconcile group security policies with the Rwandan reporting clocks, obtain NCSA authorisation to store personal data outside Rwanda and, for financial institutions, ensure BNR's access to outsourced systems. EAC and COMESA status gives no exemption from these rules.

Watch out for

Assuming that only telecommunications operators are service providers: hosting, cloud, software and platform businesses can be caught by Articles 4 to 6 of Law N° 60/2018.
Group incident policies that wait for forensic certainty before reporting, when BNR's clock runs for two hours and the NCSA's for 48 hours.
Ignoring a take-down notice from security organs while seeking legal advice; failure to act is itself an offence under Article 50.
Overlooking corporate exposure of 30% to 70% of a year's profits under Article 51, which can exceed the data protection fines.
Treating the absence of a critical infrastructure Order as an exemption; Article 24 penalties for attacks already apply and the NCSA can already audit networks under Article 10 of Law N° 26/2017.
Waiving ESP standard controls without documenting the reasons, obtaining top management approval and informing the NCSA.

Next in this chapter · 7.8E-commerce, fintech and AIThe licences and rules for selling online, running a platform, issuing e-money or offering payments, dealing in virtual assets and deploying AI in Rwanda, with the consumer rights, tax on digital supplies and the regulations still awaited.Continue →

← Personal data protection Chapter 7 overview

Related in this guide

The financial system and regulators →Payments, currency and mobile money →Due diligence in Rwanda →Regulatory, tax and public law disputes →

Related investor FAQs

Official sources

Have a question about your own situation?

Ask Be Rwanda Wise's Rwandabot, the AI legal-information chatbot. It checks official Rwandan sources and points you to the governing law, or read how to find and check a Rwandan advocate.

Ask Rwandabot about this Open in the app Find a lawyer

This page gives legal and tax information, not legal advice. Rates, thresholds and procedures change; the content is reviewed against official sources, but you should confirm anything important with the relevant authority or an advocate registered with the Rwanda Bar Association before you act. Laws are published in Kinyarwanda, English and French in the Official Gazette; check the official text before relying on a translation.