Serves under-18s, in Rwanda

Law N° 58/2021, arts. 9-12 (sensitive personal data, children's data and criminal records) · Read the law's page

• Process sensitive personal data, including genetic or biometric information, race, health status, criminal records, religious or philosophical beliefs, political opinion, sexual life or family details, only on one of the five grounds article 10 lists, such as the data subject's consent, a vital interest, public health, or archiving, scientific or statistical purposes.
• When processing sensitive personal data, build the capacity of staff involved, control who can access it, and apply technical and organisational measures appropriate to the risk, including storing it separately and applying tokenisation, pseudonymisation or encryption where appropriate.
• Comply with the retention periods this Law sets for sensitive personal data.
• Before processing personal data you know belongs to a child under sixteen, obtain the consent of a holder of parental responsibility over the child, unless the processing is necessary to protect the child's vital interest.
• Process personal data of a convict only under the supervisory authority's supervision, and put in place safeguards to respect that data subject's rights and freedoms.

Ministerial Instructions N° 001/MINICT/2024 of 22/01/2024 on Child Online Protection · Read the law's page

• Applies to any person or organisation that broadcasts or provides content online or provides access to online content, not only services aimed at children or social media platforms. The instructions do not define child, but the Law N° 71/2018 they are issued under defines a child as anyone under eighteen.
• As a digital content provider or retailer, make digital content filtering tools available, maintain plans to manage harmful online content, provide a reporting function for users, and give a clear external label describing whether platform content is suitable for children (Article 4).
• Put in place a mechanism to prevent children from accessing age-inappropriate content, sites, products or interactive services (Article 4).
• As an internet service provider, inform subscribers of risks to children, support reporting of child abuse, block access to child-abuse material once identified, and make parental-control tools available where applicable (Article 5).
• As a cybercafe or public Wi-Fi provider in a public place, proactively block access to sites known for hosting content harmful to children (Article 6).
• As a broadcaster or television service provider, indicate the suitability of content for various age categories, and implement technical barriers, including parental controls and age-verification tools, so that children are not exposed to harmful content (Article 7).
• As a social media user, refrain from creating or publishing videos of child actors in age-inappropriate roles, and from creating or publishing children's images or videos for entertainment or commercial purposes without the consent of a holder of parental responsibility (Article 8).