Rwanda passenger data: API and PNR

The law and its purpose

Law N° 006/2024 of 19/01/2024 governs collecting, transmitting, assessing and sharing API and PNR data ¹. Its stated aims are to pre-clear passengers entering, leaving or transiting Rwanda and to prevent, detect, investigate and prosecute terrorist acts and serious crimes ¹. It was published in the Official Gazette special issue of 8 March 2024 and took effect on publication ¹.

The Directorate General of Immigration and Emigration (DGIE) lists the law and the implementing order on its laws page ³. The earlier immigration law, Law N°57/2018, has an article titled obligations of transport companies ⁴.

Who sends the data and when

The law covers carriers by air, road, rail or water that hold a valid licence to carry passengers ¹. They send data by the push method to a passenger information system processed by DGIE, alone or with a State organ ¹. For code-share trips the operating carrier transmits ¹.

Ministerial Order No 001/01 of 10/05/2024 sets the timing. It covers all passengers and crew travelling to, from, through or stopping over in Rwanda ².

What data is collected

API data covers the travel document number, issuer, type and expiry date, visa details, and the holder's name, nationality, date of birth and gender ². It covers seat number, checked baggage and tag numbers, and carrier details such as flight number and scheduled times ².

PNR data covers the booking locator, ticket date, name, contact details, payment information with billing address and full itinerary ². It covers frequent flyer data, travel agent, check-in status, baggage, remarks on unaccompanied minors and the history of changes ².

Retention and safeguards

Data is kept in readable form for five years from receipt ¹. Depersonalised data is kept for five more years and then destroyed ¹. Depersonalisation masks names, contact details and payment information, and re-identification is allowed only when strictly necessary ¹.

The law bans processing data that reveals ethnicity, skin colour, religion or belief, political opinions, language, trade union membership, health or disability. Such data must be deleted at once if received ¹. Data subjects have rights of access, rectification, restriction and judicial redress ¹. A data protection officer monitors processing and breaches must be reported to the data subject and the supervisory authority ¹. Sharing with third countries needs the prior consent of the sending country, with exceptions for urgent threats ¹.

Fines for carriers

The order sets fines by transport mode. A carrier may appeal to the Director General of Immigration and Emigration within five days of notification ².