Rwanda

Rwanda regulates personal data through Law N° 058/2021 of 13 October 2021 relating to the protection of personal data and privacy, its first dedicated data protection statute, in force from 15 October 2021. The law applies to any controller or processor handling the personal data of individuals in Rwanda, including entities located outside the country, and excludes purely personal or household processing. It is grounded in the standard modern principles (lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, accountability), requires consent to be prior, free, specific, informed, and unambiguous, and recognises additional lawful bases including contractual necessity and legal obligation. Two features stand out. Sensitive categories, racial or ethnic origin, political opinions, religious or philosophical belief, health, genetic and biometric data, and sexual orientation, attract strict conditions, and data subjects hold the full suite of rights: access, rectification, erasure, restriction, portability, and objection. Second, Rwanda imposes a comparatively demanding data-localisation requirement: personal data must generally be stored within Rwanda unless the supervisory authority issues a certificate authorising offshore storage, with cross-border transfers otherwise limited to adequate jurisdictions. Breach notification to the authority is mandatory within 72 hours, with notice to affected individuals for high-risk breaches. Enforcement rests with the National Cyber Security Authority (NCSA), the designated supervisory authority, acting through its Data Protection and Privacy Office (dpo.gov.rw). Locating data protection supervision within the cybersecurity authority is a distinctive institutional choice. With an in-force modern statute and a named, operational regulator, Rwanda has one of the more robust frameworks in East Africa, its localisation regime making it notably stricter than several neighbours.