RwandaLaw relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data
Law N° 58/2021, arts. 9-12 (sensitive personal data, children's data and criminal records)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Biometric, Age verification, Access restriction, Security, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Process sensitive personal data, including genetic or biometric information, race, health status, criminal records, religious or philosophical beliefs, political opinion, sexual life or family details, only on one of the five grounds article 10 lists, such as the data subject's consent, a vital interest, public health, or archiving, scientific or statistical purposes.NIST Privacy FrameworkCT.PO-P1
- When processing sensitive personal data, build the capacity of staff involved, control who can access it, and apply technical and organisational measures appropriate to the risk, including storing it separately and applying tokenisation, pseudonymisation or encryption where appropriate.NIST Privacy FrameworkPR.AC-P4NIST Privacy FrameworkPR.DS-P1NIST Privacy FrameworkGV.AT-P1
- Comply with the retention periods this Law sets for sensitive personal data.NIST Privacy FrameworkCT.PO-P2
- Before processing personal data you know belongs to a child under sixteen, obtain the consent of a holder of parental responsibility over the child, unless the processing is necessary to protect the child's vital interest.NIST Privacy FrameworkCT.PO-P1
- Process personal data of a convict only under the supervisory authority's supervision, and put in place safeguards to respect that data subject's rights and freedoms.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.AT-P1The workforce is informed and trained on its roles and responsibilities.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- PR.DS-P1Data-at-rest are protected.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
6 more
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-023Agentic System Credential Protection Framework
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 9 to 12 set consent for a child's data, the grounds for processing sensitive data, safeguards (Article 11) and supervision of the processing of a convict's data (Article 12). Article 11(1) refers to personal data monitoring requirements 'as required by this Law' without naming a log or a record, and Articles 9 to 12 state no record, log or period of their own. The logging duty is in Articles 16 and 17, which this row does not cite. Article 12 places convict data processing under the supervisory authority's supervision, which is the regulator's power to check and names no record.
- Kind
- None
- As of
What this law does
Article 9 requires the consent of a holder of parental responsibility before processing personal data belonging to a child under sixteen, permits that consent only where given in the child's interest, and dispenses with it where processing is necessary to protect the child's vital interest.
Article 10 permits processing sensitive personal data, defined at article 3 to include race, health status, criminal records, medical records, social origin, religious or philosophical beliefs, political opinion, genetic or biometric information, sexual life and family details, only on the data subject's consent, the controller's or processor's legal obligations, a vital interest, public health, or archiving, scientific, historical or statistical purposes.
Article 11 layers safeguards onto that processing: compliance with the sensitive-data retention periods this Law sets, staff-capacity building, controls on who may access it, and technical and organisational measures appropriate to the risk, including storing it separately from other data and applying tokenisation, pseudonymisation or encryption.
Article 12 places processing personal data of a convict, whose criminal record is itself a category of sensitive personal data, under the supervisory authority's supervision, and requires safeguards for that data subject's rights and freedoms.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .