Duty LXD-7158
Runs an essential service, in Rwanda
Law relating to the Protection of Personal Data and Privacy, personal data breach notificationsince 4 lines
Law N° 58/2021, arts. 43-45 (personal data breach notification) · Read the law's page
- Notify the supervisory authority of the breach within 48 hours of becoming aware of it.
- As a data processor, notify the data controller of the breach within 48 hours of becoming aware of it.
- Submit a full report on the breach to the supervisory authority within 72 hours, describing its nature, the contact point for more information, the measures taken to address it, and your proposal and timeline for communicating it to affected data subjects.
- Communicate the breach to the affected data subject, in writing or electronically after becoming aware of it, where it is likely to result in a high risk to their rights and freedoms; this Law fixes no separate deadline for that communication, and excuses it only where you had already protected the data, neutralised the risk, or made an equally effective public communication.