Rwanda. Comprehensive data protection. Law
Law 058/2021Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy
In force
§1Summary
- Synopsis
Rwanda's comprehensive data protection law, supervised by the NCSA. It sets GDPR-like principles and rights and couples them with mandatory registration and a default rule that personal data be stored in Rwanda.
- Key themes
- Unique features
Strong localisation: personal data must be stored in Rwanda unless the controller/processor holds a registration certificate authorising storage abroad (art. 50). All controllers and processors must register with the NCSA, and breaches must be reported within 48 hours.
- SaaS relevance
A SaaS provider processing Rwandan personal data must register with NCSA and obtain explicit authorisation in its certificate to host data outside Rwanda.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- NCSA within 48h; data subjects if high risk
- DPO
- Conditional
- Cross-border transfers
- Localisation by default; NCSA authorisation, consent or contract necessity plus written contract
- Maximum penalty
- Administrative 1% of global turnover (RWF 2-5m for others); corporate criminal fine 5% of annual turnover
§3Dates
- Key dates
- Adopted
- In force
- Published 2021-10-15; two-year transition ended 2023-10-15
§4Text and authority
- Text
- Authoritative text dpo.gov.rw
- Authority
- National Cyber Security Authority (NCSA) – Data Protection and Privacy Office
§5Where it applies
- Domestic law of
- Rwanda
§6Sources and verification
- Verification
High confidence.
Authority URL (dpo.gov.rw) not fetched this session.