RwandaLaw relating to the Protection of Personal Data and Privacy, personal data breach notification
Law N° 58/2021, arts. 43-45 (personal data breach notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the supervisory authority of the breach within 48 hours of becoming aware of it.
- As a data processor, notify the data controller of the breach within 48 hours of becoming aware of it.
- Submit a full report on the breach to the supervisory authority within 72 hours, describing its nature, the contact point for more information, the measures taken to address it, and your proposal and timeline for communicating it to affected data subjects.
- Communicate the breach to the affected data subject, in writing or electronically after becoming aware of it, where it is likely to result in a high risk to their rights and freedoms; this Law fixes no separate deadline for that communication, and excuses it only where you had already protected the data, neutralised the risk, or made an equally effective public communication.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 43 requires notice of a personal data breach to the supervisory authority within 48 hours (a processor tells the controller within 48 hours), Article 44 a report to the authority within 72 hours listing the breach's nature, contacts, measures and a proposed communication to data subjects, and Article 45 notice to the data subject where the risk is high. These are notifications sent to others; no article here tells the controller to keep a register of breaches or to document breaches it does not notify, and nobody is entitled to examine a kept record. Article 45 lets the authority ask the controller to tell the data subject, which is a request for action, not a check of a record.
- Kind
- None
- As of
What this law does
Article 43 requires the data controller, within forty-eight hours of becoming aware of a personal data breach, to notify it to the supervisory authority, and requires a data processor who becomes aware of a breach to notify the data controller within the same forty-eight hours.
Article 44 requires the data controller to submit a full report to the supervisory authority no later than seventy-two hours after becoming aware of the breach, describing its nature, the affected categories and approximate numbers of data subjects and records, the data protection officer's or other contact point's details, the measures taken or proposed to address it and mitigate its effects, and a proposal and timeline for communicating it to affected data subjects.
Article 45 requires the data controller to communicate a breach likely to result in a high risk to a data subject's rights and freedoms to that data subject, in writing or electronically, after becoming aware of it, but sets no separate deadline for that communication, and excuses it where the data was already protected by measures such as encryption, the high risk is no longer likely to materialize, or an equally effective public communication was made instead; the supervisory authority may still require the communication to be made.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .