Rwanda's data protection law and border data

Scope of the law

The law sets rules for processing personal data by electronic or other means. It applies to controllers, processors and third parties established or living in Rwanda. It covers processing of data about people located in Rwanda by those not established there ¹. Personal data means any information relating to an identified or identifiable natural person ¹. Sensitive data includes health status, criminal records and biometric or genetic information ¹.

The supervisory authority is defined as the public authority in charge of cyber security ¹. The Ministry of Trade and Industry names it as the National Cyber Security Authority ⁸. Law No 058/2021 comes into force on publication in the Official Gazette ⁶. Existing controllers and processors had up to two years from publication to comply ⁶.

Registration and duties

A person who intends to be a data controller or processor must register with the authority ². The application lists the data held, the purposes, the recipients and the countries to which data may be transferred ². The authority issues a certificate within 30 working days to applicants who meet the requirements ². Changes must be reported within 15 working days ².

Controllers and processors must keep records of processing and carry out an impact assessment where processing is likely to pose high risk ³. Public and private bodies other than courts must designate a data protection officer ³. A breach must be notified to the authority within 48 hours of becoming aware of it, with a report within 72 hours ³.

In one public example, MINICOM and its agencies RICA, RSB, NIRDA and RCA received controller and processor certificates from the National Cyber Security Authority ⁸.

Transfers and storage abroad

Personal data may be transferred outside Rwanda on grounds such as authorisation by the supervisory authority after proof of appropriate safeguards, the data subject's consent or the establishment, exercise or defence of a legal claim ⁴. A contract setting out the roles and responsibilities of each party is required when data is shared with or transferred to a third party abroad ⁴. Storage outside Rwanda is allowed only for a controller or processor holding a valid certificate that authorises it ⁴. The Data Protection and Privacy Office runs online services for authorisation to transfer and to store outside Rwanda ⁷.

Data may be kept only until the purpose is met. Longer retention is allowed on grounds such as authorisation by law, a contract between the parties, court proceedings or the data subject's consent ⁴.

Penalties

Border and trade data

The Rwanda Revenue Authority e-Single Window collects the information and documents that import, export and transit rules require, submitted once for all agencies ¹⁰. Users of the Customs Mobile Declaration register at a customs office and receive payment details by SMS to their phone number ¹⁰.

Consumers who join the VAT reward scheme give a name, a Rwandan mobile number, a Mobile Money or bank account and a national ID ⁹. Their phone number must appear on each EBM invoice ⁹.

The sources opened for this page do not state which sector regulations, if any, the authority has issued for customs or immigration data under Article 66 ⁶.