Processes personal data, in Rwanda

Law N° 58/2021, arts. 1-8, 13-17, 29-41, 46-47 and 51-52, relating to the Protection of Personal Data and Privacy · Read the law's page

• Have a lawful basis under this Law, such as the data subject's consent or one of the other seven grounds article 46 lists, before processing personal data.
• Where consent is the basis for processing, obtain it only after the data subject is informed of the consequences of consenting, and let the data subject withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
• Enter into a written contract with a data processor before it processes personal data on your behalf, and authorise only a processor who gives sufficient guarantees to implement appropriate technical and organisational measures.
• Register with the supervisory authority as a data controller or data processor before processing personal data, and designate a data protection officer where article 40 requires one.
• Log every collection, alteration, access, disclosure, combination and erasure of personal data, and maintain a record of all processing activities, producing both to the supervisory authority on request.
• Implement appropriate technical measures against loss, damage or destruction of personal data, verify regularly that they work, and keep them updated against new or identified risks.
• Carry out a data protection impact assessment before processing likely to result in a high risk to a natural person's rights and freedoms, including large-scale processing of sensitive personal data or systematic monitoring of a publicly accessible area on a large scale.
• Retain personal data only until the purpose of processing is fulfilled unless a listed ground extends retention, and destroy it in a manner that prevents reconstruction once the retention period ends.

Law N° 58/2021, arts. 18-20 and 22-26 and 42 (rights of the data subject and the information notice) · Read the law's page

• On a data subject's written or electronic request, provide the purposes of processing, a copy of their personal data, a description of what you hold including third-party recipients, the source of data not obtained from them, and whether it was transferred to a third country or an international organisation, subject to the listed exceptions such as another person's rights, legal privilege, or confidential examination materials.
• Within thirty days of a request to object, port, erase or rectify personal data, tell the data subject in writing or electronically whether you complied and, if not, why, and expect the supervisory authority to answer an appeal against your response within sixty days.
• Stop processing a data subject's personal data on their objection, including for direct marketing or related profiling, unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms.
• On request, resend a data subject's personal data in a structured, readable format, or transmit it directly to another data controller where technically feasible.
• Restrict processing at a data subject's or the supervisory authority's request while accuracy is contested, an objection is under review, or unlawful processing is alleged, and tell the data subject before lifting a restriction imposed because processing was unlawful.
• Erase a data subject's personal data on request where it is no longer necessary, consent has been withdrawn, they object, or it was unlawfully processed, and tell any third party you disclosed it to, or posted it publicly, that erasure was requested.
• Before or when collecting personal data, tell the data subject your identity and contact details, the purposes and recipients, whether provision is mandatory, their rights including to withdraw consent, access, rectify, restrict, erase, object and appeal, the retention period, and the existence and consequences of any automated decision making.

Law N° 58/2021, arts. 27-28 and 53-65 (supervisory authority, penalties, offences and compensation) · Read the law's page

• Comply with the supervisory authority's oversight, including its inspections, its register of data controllers and processors, and any regulation it issues to implement this Law.
• Expect an administrative fine of RWF 2,000,000 to 5,000,000, or one percent of your preceding year's global turnover, for misconducts including failing to register, log processing, maintain records, designate a data protection officer, or notify, report or communicate a breach; a corporate body or legal entity is fined one percent of global turnover alone.
• Expect criminal liability, on conviction, for unlawfully accessing, using, sharing, transferring or disclosing personal data, re-identifying de-identified data, destroying or altering data, selling data, unlawfully collecting or processing sensitive personal data, or providing false registration information, each carrying its own imprisonment and fine range, with a fine of five percent of turnover where a corporate body or legal entity is convicted.
• Expect a data subject who suffers serious damage from your violation of this Law to have the right to claim compensation before a competent court, unless you prove you were not responsible for the damage.
• Expect the supervisory authority to be the organ that settles conflicts arising under this Law in the first instance, subject to your right to take an unresolved conflict, or a disputed administrative sanction, to a competent court.

Law N° 58/2021, arts. 43-45 (personal data breach notification) · Read the law's page

• Notify the supervisory authority of the breach within 48 hours of becoming aware of it.
• As a data processor, notify the data controller of the breach within 48 hours of becoming aware of it.
• Submit a full report on the breach to the supervisory authority within 72 hours, describing its nature, the contact point for more information, the measures taken to address it, and your proposal and timeline for communicating it to affected data subjects.
• Communicate the breach to the affected data subject, in writing or electronically after becoming aware of it, where it is likely to result in a high risk to their rights and freedoms; this Law fixes no separate deadline for that communication, and excuses it only where you had already protected the data, neutralised the risk, or made an equally effective public communication.

Law N° 58/2021, arts. 48-50 (cross-border transfer and data localisation) · Read the law's page

• Do not share or transfer personal data to a third party outside Rwanda unless you have the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, or another listed ground such as contract necessity, public interest, a legal claim, or a ratified international instrument.
• Enter into a written contract with anyone you authorise to access, share or transfer personal data outside Rwanda, setting out each party's respective roles and responsibilities.
• Store personal data in Rwanda, and store it outside Rwanda only where you hold a valid registration certificate from the supervisory authority authorising storage abroad.
• Be ready to demonstrate compliance with the transfer safeguards this Law requires, including where a transfer rests on your own compelling legitimate interests, and expect the supervisory authority to prohibit or suspend an outbound transfer to protect data subjects' rights.

Law N° 58/2021, arts. 9-12 (sensitive personal data, children's data and criminal records) · Read the law's page

• Process sensitive personal data, including genetic or biometric information, race, health status, criminal records, religious or philosophical beliefs, political opinion, sexual life or family details, only on one of the five grounds article 10 lists, such as the data subject's consent, a vital interest, public health, or archiving, scientific or statistical purposes.
• When processing sensitive personal data, build the capacity of staff involved, control who can access it, and apply technical and organisational measures appropriate to the risk, including storing it separately and applying tokenisation, pseudonymisation or encryption where appropriate.
• Comply with the retention periods this Law sets for sensitive personal data.
• Before processing personal data you know belongs to a child under sixteen, obtain the consent of a holder of parental responsibility over the child, unless the processing is necessary to protect the child's vital interest.
• Process personal data of a convict only under the supervisory authority's supervision, and put in place safeguards to respect that data subject's rights and freedoms.