Personal data protection: Law N° 058/2021 and its reach abroad, registration with the National Cyber Security Authority within 30 working days, the representative and the data protection officer, lawful bases and data subject rights, breach notice within 48 hours and a report within 72 hours, transfers abroad, the rule that data is stored in Rwanda, and fines of 1% and 5% of turnover

The law and who it reaches

Rwanda's data protection statute is Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy (the Data Protection Law), published in the Official Gazette n° Special of 15/10/2021 and in force on publication (Article 70). Article 67 gave controllers and processors already in operation two years from publication to conform, so the transitional period ended in October 2023 and the Law has been fully enforceable since then. It is modelled on the European approach, with registration requirements and a storage rule that go further. No amendment had been published by 10 October 2026 (FAQ 81).

The Law applies to the processing of personal data by electronic or other means, by a data controller (the person that determines the purposes and means of processing) or a data processor (the person that processes on the controller's behalf) established or resident in Rwanda, and also by a controller or processor that is neither established nor resident in Rwanda but processes personal data of data subjects located in Rwanda (Article 2). A foreign platform, software provider or group service centre that handles data of people in Rwanda is therefore within its scope even with no Rwandan entity. Sensitive personal data includes information revealing race, health status, criminal records, medical records, social origin, religious or philosophical beliefs, political opinion, genetic or biometric information, sexual life and family details (Article 3), and its processing is allowed only on the narrower grounds in Article 10.

The supervisory authority is the National Cyber Security Authority (NCSA), established by Law N° 26/2017 of 31/05/2017 and placed under the Office of the President, which acts through its Data Protection and Privacy Office (dpo.gov.rw). Its duties include keeping the register of controllers and processors, investigating complaints, deciding data subjects' appeals and imposing administrative sanctions (Articles 27 and 28). For Data Privacy Week in January 2026 the NCSA's theme was reported in the press as "Compliance is Beyond Registration", signalling a shift from counting registrations to checking how companies process data; no published administrative fines or prosecutions had been located by 10 October 2026.

Registering with the NCSA

Article 29 requires every person who intends to be a data controller or data processor to register with the supervisory authority. The application states the applicant's identity and single point of contact, its representative, the personal data and categories of data subjects, the purposes, the recipients, the countries to which data will be transferred directly or indirectly, and the risks and safeguards (Article 30). The NCSA issues the certificate within 30 working days of receiving a complete application (Article 31). After that, any change in the grounds on which the certificate was issued is notified within 15 working days (Article 32), renewal is applied for 45 working days before expiry and answered within 30 working days (Article 33), and the NCSA may modify the certificate or cancel it for false information or non-compliance after giving 15 working days' notice (Articles 34 and 35).

The NCSA's Registration Guide sets out the practice. There are separate forms for controllers and processors, and a company that is both, for example a service provider that is a controller of its own staff data and a processor of its clients' data, files both and obtains two certificates. The form is accompanied by a letter to the Chief Executive Officer of the NCSA, the certificate of incorporation, any sector licence (for example from the Rwanda Utilities Regulatory Authority (RURA)), the contract with the representative for a foreign applicant, and supporting documents such as processor contracts and the privacy notice. The documents are sent as PDF files by email to registration@dpo.gov.rw and dpp@ncsa.gov.rw. There is no registration fee. An incomplete or rejected application receives a reasoned refusal notice within seven working days, and a new application can be made once the defects are cured.

Two points need attention. First, the period of validity of the certificate is to be set by an NCSA regulation (Article 31), which had not been located at 10 October 2026; the Guide states that a certificate remains valid until the expiry date shown on it, so the date on the certificate governs the renewal timetable. Second, the application is the place to obtain authorisation for storage outside Rwanda and to disclose the countries of transfer, so an investor planning to host data abroad should say so in the application rather than seek authorisation later.

The representative and the data protection officer

A controller or processor that is neither established nor resident in Rwanda but processes personal data of data subjects located in Rwanda must designate in writing a representative in Rwanda to comply with its obligations under the Law (Article 39). The representative contract is filed with the registration application, and an NCSA regulation on designation is foreseen but had not been located. In practice the representative is a Rwandan law firm, compliance firm or group company, and it should have authority to receive NCSA correspondence and coordinate breach notices within the 48-hour window.

A data protection officer (DPO) must be designated where the processing is carried out by a public or private corporate body or a legal entity, except courts; where the core activities consist of regular and systematic monitoring of data subjects on a large scale; or where they consist of large-scale processing of sensitive data or criminal conviction data (Article 40). Because the first limb covers any corporate body or legal entity, in effect every company that processes personal data, including its own employees' data, needs a DPO. A group may appoint a single DPO if the officer is easily accessible from each establishment, and the DPO may be an employee or an external provider under a service contract. The officer must have professional qualities and expert knowledge of data protection, and the controller must publish the DPO's contact details and communicate them to the NCSA. The DPO informs and advises the business, monitors compliance, advises on impact assessments and is the NCSA's contact point (Article 41). Failure to designate a DPO is an administrative misconduct under Article 53.

Lawful processing, notices and data subject rights

Processing is lawful only on one of the grounds in Article 46: consent for purposes explained to the data subject; performance of a contract with the data subject or steps at the data subject's request before contracting; a legal obligation; vital interests; a task in the public interest or official authority; the duties of a public entity; legitimate interests not overridden by the data subject's rights; or research authorised by the relevant institution. Consent must be informed and provable, and a child under 16 is represented by a person with parental authority (Articles 9 and 26). Processing must also respect the principles of lawfulness, fairness, transparency, purpose limitation, relevance, accuracy and storage limitation (Article 37). On collection, the controller tells the data subject its identity, the purposes, recipients, whether supplying the data is voluntary, the right to withdraw consent, the rights of access and correction, any automated decision-making, the storage period, the right to appeal to the NCSA and, where applicable, that the data may be transferred outside Rwanda (Article 42).

Data subjects have rights of access to their data and information about its processing, source and any transfer abroad (Article 18), to object, including at any time to direct marketing and related profiling (Article 19), to portability (Article 20), not to be subject to a decision based solely on automated processing with legal or significant effects unless based on explicit consent, a contract or law with safeguards (Article 21), to restriction (Article 22), to erasure (Article 23), to rectification (Article 24), to designate an heir to their personal data by will (Article 25) and to representation (Article 26). For objection, portability, erasure and rectification, the controller must respond in writing or electronically within 30 days of the request; a dissatisfied data subject may appeal to the NCSA within 30 days of the response, and the NCSA responds within 60 days (Articles 18 to 24). A business that serves consumers should have a written procedure, a single intake channel and a log of requests and replies.

Accountability: records, logs, impact assessments and security

The Law requires evidence of compliance, not only good practice. A controller and processor keep a record of processing operations (Articles 17 and 38) and log collection, alteration, consultation, disclosure and erasure of personal data (Article 16); failing to keep records or logs is an administrative misconduct under Article 53. A processor acts under a written contract with the controller (Article 4). A data protection impact assessment is required where processing is likely to result in a high risk, and in particular for systematic and extensive evaluation of personal aspects by automated processing, including profiling, on which decisions are based; large-scale processing of sensitive data; systematic large-scale monitoring of a publicly accessible area; processing the NCSA identifies as high-risk; and new technologies used to process personal data (Article 38).

Security is an obligation of result managed by process: the controller or processor identifies foreseeable risks, establishes safeguards, verifies them regularly and updates them in response to new risks (Article 47), and the NCSA may inspect and assess those measures where it considers that processing or transfer may infringe privacy. Personal data is retained only until the purposes of processing are fulfilled, unless a listed ground such as a legal requirement, a contract, litigation or the data subject's consent justifies longer retention, and it must then be destroyed in a way that prevents its reconstruction in an intelligible form (Article 52). The cybersecurity standards and incident duties that sit alongside these rules are covered in Cybersecurity and critical information.

Personal data breaches: 48 hours and 72 hours

Rwanda's breach timetable is short. The controller must communicate a personal data breach to the NCSA within 48 hours after becoming aware of the incident, and a processor that becomes aware of a breach must notify the controller within 48 hours (Article 43). The controller then submits a report within 72 hours with the facts available, describing the nature of the breach and, where possible, the categories and approximate numbers of data subjects and records, the DPO's contact details, the measures taken to address and mitigate it, its consequences and the remedial measures, and the controller's proposal and timeline for communicating the breach to the data subjects, for the NCSA's approval (Article 44). Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, the controller communicates it to them in writing or electronically, unless effective protection such as encryption, subsequent measures or an equally effective public communication makes this unnecessary, and the NCSA may require communication (Article 45).

Failure to notify, to report or to communicate a breach is each an administrative misconduct under Article 53. The NCSA's portal provides a breach reporting channel, and a breach that is also a cyber incident may need to be reported to the NCSA's Rwanda Computer Security Incident Response Team (Rw-CSIRT) and, for a financial institution, to the National Bank of Rwanda (BNR) within two hours under BNR's cyber security regulation. Groups with a global incident policy built around the European 72-hour rule should shorten the Rwandan clock to 48 hours for the first notice and require processors to report within the same period.

Transfers abroad and the rule that data is stored in Rwanda

The Law treats transfer and storage separately, and the difference matters for cloud hosting. Under Article 48 a controller or processor may share or transfer personal data to a third party outside Rwanda if it has obtained the NCSA's authorisation after providing proof of appropriate safeguards; if the data subject has consented; or if the transfer is necessary for a contract with or in the interest of the data subject, for public interest grounds, for legal claims, to protect vital interests, for compelling legitimate interests where the transfer is not repetitive and concerns a limited number of data subjects with suitable safeguards, or for the performance of international instruments ratified by Rwanda. Each transfer requires a written contract setting out the parties' roles and responsibilities, whose form the NCSA may prescribe, and the NCSA may prohibit or suspend transfers to protect data subjects (Article 49). The NCSA's portal offers standard contractual clauses and applications for authorisation to transfer.

Article 50 is stricter: "The data controller or the data processor stores personal data in Rwanda", and storage outside Rwanda is permitted only if the controller or processor holds a valid registration certificate authorising it, issued by the NCSA. A business using a foreign cloud provider, a group data centre or an offshore software-as-a-service platform is storing data abroad and needs that authorisation on its certificate; reliance on consent or contractual necessity under Article 48 covers transfer, not storage. In practice the NCSA's forms ask whether data is stored outside Rwanda, and the authorisation is sought in the registration or by amending the certificate. When a business changes or closes, the migration and management of its personal data will follow an NCSA regulation still to be adopted (Article 51). Financial institutions face an additional layer: BNR's outsourcing regulation allows offshore outsourcing only where BNR's access is not impeded, as described in Cybersecurity and critical information.

Setting up a compliant data protection programme in Rwanda, step by step

1. Map the dataList the personal data, data subjects, purposes, lawful bases under Article 46, recipients, processors, countries of transfer and storage locations; this map becomes the Article 17 record and the registration form.
2. Appoint the peopleDesignate a DPO under Article 40 and, for a foreign controller or processor, a written representative in Rwanda under Article 39; publish the DPO's contact details.
3. Register with the NCSAFile the controller and, if relevant, processor forms with the supporting documents by email; ask for authorisation to store data outside Rwanda where any hosting is offshore. No fee; certificate within 30 working days.
4. Paper the relationshipsSign processor contracts (Article 4) and transfer contracts for each cross-border flow (Article 49), using the NCSA's standard clauses where suitable.
5. Publish notices and rights proceduresIssue privacy notices with the Article 42 content and set up a procedure to answer access, objection, portability, erasure and rectification requests within 30 days.
6. Assess and secureCarry out impact assessments for high-risk processing and new technologies (Article 38), implement and test security measures (Article 47) and keep logs (Article 16).
7. Prepare for breachesAdopt an incident plan that notifies the NCSA within 48 hours and reports within 72 hours, with processors bound to report within 48 hours.
8. Maintain the certificateNotify changes within 15 working days, diarise renewal 45 working days before the expiry date on the certificate and review retention and destruction annually.