Law N° 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy
rw-dpl-2021 · Act
Law N° 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy is Rwanda's first dedicated data protection statute. Signed on 13 October 2021 and published in Official Gazette No. Special of 15 October 2021, it entered into force on 15 October 2021. The law establishes a comprehensive legal framework governing all personal data processing activities in Rwanda and designates the National Cyber Security Authority (NCSA), operating through its Data Protection and Privacy (DPP) Office at dpo.gov.rw, as the supervisory authority. The law applies to any data controller or data processor that processes personal data of individuals in Rwanda, including entities located outside Rwanda. Household and purely personal processing activities are excluded. The extraterritorial reach means that foreign organisations handling data of Rwanda-based individuals must comply. The law is grounded in core principles reflecting international best practice: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Data subjects' consent must be prior, free, specific, informed, and unambiguous. Other recognised lawful bases include contractual necessity, compliance with a legal obligation, protection of vital interests, and legitimate interests of the controller. Special categories of sensitive personal data, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, health or medical data, genetic data, biometric data, and data concerning a person's sexual orientation, attract stricter requirements and may only be processed on specific, limited grounds. Data subjects are granted a comprehensive set of rights: the right to be informed about processing activities, the right of access to their personal data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object to processing. A distinctive feature of Rwanda's framework is the data localisation requirement: personal data must generally be stored within Rwanda unless the NCSA issues a certificate authorising offshore storage. Cross-border transfers are otherwise permitted only to countries with adequate protection. Breach notification is mandatory: controllers must notify the NCSA within 72 hours of becoming aware of a personal data breach, and must inform affected data subjects where the breach poses a high risk to their rights and freedoms. Administrative penalties and criminal sanctions are available for non-compliance.
- Designates the National Cyber Security Authority (NCSA), operating through its Data Protection and Privacy Office (dpo.gov.rw), as Rwanda's supervisory authority for personal data protection.
- Applies to all data controllers and processors handling personal data of individuals in Rwanda, including entities established outside the country.
- Requires prior, free, specific, informed, and unambiguous consent as the primary lawful basis for processing, alongside other recognised bases including contractual necessity and legal obligation.
- Imposes strict processing conditions for sensitive personal data, including health, biometric, genetic, and racial or ethnic origin data.
- Grants data subjects rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing.
- Requires that personal data be stored within Rwanda unless the NCSA issues a certificate authorising offshore data storage, restricting cross-border transfers to countries with adequate protection.
- Mandates breach notification to the NCSA within 72 hours of becoming aware of a personal data breach, with notification to affected data subjects where high risk to their rights and freedoms exists.
- Provides for administrative penalties and criminal sanctions for non-compliance with the law's requirements.