RwandaLaw relating to the Protection of Personal Data and Privacy, cross-border transfer and data storage
Law N° 58/2021, arts. 48-50 (cross-border transfer and data localisation)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction, Contract terms
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not share or transfer personal data to a third party outside Rwanda unless you have the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, or another listed ground such as contract necessity, public interest, a legal claim, or a ratified international instrument.NIST Privacy FrameworkCT.PO-P2
- Enter into a written contract with anyone you authorise to access, share or transfer personal data outside Rwanda, setting out each party's respective roles and responsibilities.NIST Privacy FrameworkID.DE-P3
- Store personal data in Rwanda, and store it outside Rwanda only where you hold a valid registration certificate from the supervisory authority authorising storage abroad.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.IM-P7
- Be ready to demonstrate compliance with the transfer safeguards this Law requires, including where a transfer rests on your own compelling legitimate interests, and expect the supervisory authority to prohibit or suspend an outbound transfer to protect data subjects' rights.NIST Privacy FrameworkGV.MT-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 48 sets the grounds for a transfer outside Rwanda, Article 49 requires a written contract with the recipient and lets the supervisory authority require the controller or processor to demonstrate compliance with that Article or prohibit or suspend a transfer, and Article 50 requires storage in Rwanda unless a registration certificate allows storage abroad. A contract is not a log or record of processing, and the power to require a demonstration of compliance names no record, so the row states no logging duty; the power is the regulator's own and is coded as an on-request check. The record of transfers is part of the Article 17 record, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 48 permits a data controller or data processor to share or transfer personal data to a third party outside Rwanda only on a listed ground: the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, contractual necessity, public interest, the establishment or defence of a legal claim, protecting a vital interest, the controller's or processor's own compelling legitimate interests where the transfer is not repetitive and safeguards have been assessed, or performance of an international instrument Rwanda has ratified.
Article 49 requires a written contract with anyone authorised to access, share or transfer personal data outside Rwanda, and lets the supervisory authority demand proof of compliance or prohibit or suspend a transfer to protect data subjects' rights. Article 50 requires personal data to be stored in Rwanda, permitting storage abroad only where the controller or processor holds a valid registration certificate from the supervisory authority authorising it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .