RwandaLaw relating to the Protection of Personal Data and Privacy, rights of the data subject
Law N° 58/2021, arts. 18-20 and 22-26 and 42 (rights of the data subject and the information notice)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- On a data subject's written or electronic request, provide the purposes of processing, a copy of their personal data, a description of what you hold including third-party recipients, the source of data not obtained from them, and whether it was transferred to a third country or an international organisation, subject to the listed exceptions such as another person's rights, legal privilege, or confidential examination materials.NIST Privacy FrameworkCT.DM-P1
- Within thirty days of a request to object, port, erase or rectify personal data, tell the data subject in writing or electronically whether you complied and, if not, why, and expect the supervisory authority to answer an appeal against your response within sixty days.NIST Privacy FrameworkCT.PO-P3
- Stop processing a data subject's personal data on their objection, including for direct marketing or related profiling, unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms.NIST Privacy FrameworkCT.PO-P3
- On request, resend a data subject's personal data in a structured, readable format, or transmit it directly to another data controller where technically feasible.NIST Privacy FrameworkCT.DM-P2
- Restrict processing at a data subject's or the supervisory authority's request while accuracy is contested, an objection is under review, or unlawful processing is alleged, and tell the data subject before lifting a restriction imposed because processing was unlawful.NIST Privacy FrameworkCT.PO-P3
- Erase a data subject's personal data on request where it is no longer necessary, consent has been withdrawn, they object, or it was unlawfully processed, and tell any third party you disclosed it to, or posted it publicly, that erasure was requested.NIST Privacy FrameworkCT.DM-P4NIST Privacy FrameworkCM.AW-P5
- Before or when collecting personal data, tell the data subject your identity and contact details, the purposes and recipients, whether provision is mandatory, their rights including to withdraw consent, access, rectify, restrict, erase, object and appeal, the retention period, and the existence and consequences of any automated decision making.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 18 to 26 give the data subject rights of access, objection, portability, rectification, erasure, restriction and representation, and Article 42 requires an information notice at collection. None of them requires the controller to keep a log or a record, to demonstrate anything, or to produce anything to the supervisory authority; the appeal to the authority in these articles is a complaint route, not a check of a record. The logging and record duties are in Articles 16 and 17, which this row does not cite.
- Kind
- None
- As of
What this law does
Articles 18 to 26 give the data subject rights of access, objection, portability, rectification, erasure, and restriction of processing. Article 22 lets the data subject or the supervisory authority restrict processing while accuracy, lawfulness, or an objection is being resolved, article 25 excludes personal data from succession except by will, and article 26 lets a minor, a person with a physical or mental impairment, or anyone else designate a representative to exercise these rights.
A data subject dissatisfied with a controller's or processor's response to an objection, portability, erasure, or rectification request may appeal to the supervisory authority within thirty days, which must answer the appeal within sixty days.
Article 42 requires the data controller, when collecting personal data, to give the data subject an information notice covering identity and contact details, the purposes and recipients of processing, whether provision of the data is mandatory, the existence and consequences of automated decision making, the retention period, and the rights this Law gives the data subject, including the right to withdraw consent and to appeal to the supervisory authority.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .