Law / Rwanda

Law relating to the Protection of Personal Data and Privacy

Law N° 58/2021, arts. 1-8, 13-17, 29-41, 46-47 and 51-52, relating to the Protection of Personal Data and Privacy

In force since 15 Oct 2021.

A comprehensive regime rule binding public and private bodies.

How the hook was established: express
What makes it apply: Operator establishment, User location
Obligation class: Consent, Contract terms, Licensing, Governance, Security, DPIA, Retention
Audit expectation: on_request
Who audits it: Regulator

What it requires

Have a lawful basis under this Law, such as the data subject's consent or one of the other seven grounds article 46 lists, before processing personal data.NIST Privacy FrameworkCT.PO-P1
Where consent is the basis for processing, obtain it only after the data subject is informed of the consequences of consenting, and let the data subject withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.NIST Privacy FrameworkCT.PO-P1
Enter into a written contract with a data processor before it processes personal data on your behalf, and authorise only a processor who gives sufficient guarantees to implement appropriate technical and organisational measures.NIST Privacy FrameworkID.DE-P3
Register with the supervisory authority as a data controller or data processor before processing personal data, and designate a data protection officer where article 40 requires one.NIST Privacy FrameworkGV.PO-P5 NIST Privacy FrameworkGV.PO-P3
Log every collection, alteration, access, disclosure, combination and erasure of personal data, and maintain a record of all processing activities, producing both to the supervisory authority on request.NIST Privacy FrameworkCT.DM-P8 NIST Privacy FrameworkID.IM-P4
Implement appropriate technical measures against loss, damage or destruction of personal data, verify regularly that they work, and keep them updated against new or identified risks.NIST Privacy FrameworkPR.DS-P5
Carry out a data protection impact assessment before processing likely to result in a high risk to a natural person's rights and freedoms, including large-scale processing of sensitive personal data or systematic monitoring of a publicly accessible area on a large scale.NIST Privacy FrameworkID.RA-P4
Retain personal data only until the purpose of processing is fulfilled unless a listed ground extends retention, and destroy it in a manner that prevents reconstruction once the retention period ends.NIST Privacy FrameworkCT.DM-P5

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

ID.IM-P4Data actions of the systems/products/services are inventoried.
ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.

3 more

CT.DM-P5Data are destroyed according to policy.
CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
PR.DS-P5Protections against data leaks are implemented.

NIST CSF 2.0

GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

What the log must hold

Event time, Actor identity, Access record

Logging duty

Article 16 requires the controller or processor to log personal data operations (data collected, altered, accessed, disclosed including sharing and transfer, combined and erased), Article 17 requires a record of all processing activities that goes to the supervisory authority on request, and Article 38(2) lists keeping a record of processing operations among the controller's and processor's duties. Article 16 sets the logging's contents; Article 17 names purposes, categories and recipients, which are not log-content values. The Article 6 consent clause has the data subject demonstrate consent rather than the controller, so no consent record is read from it. No period for keeping the log or the record is stated: Article 17(6) asks only for the envisaged retention periods of the personal data. Article 2(2)(a) also reaches a controller who is established or resides in Rwanda and processes personal data while in Rwanda; no hook value is coded for a processing-location test.

Kind: Explicit
As of: 28 October 2026
Provision: Articles 16, 17 and 38(2)
Trigger: personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 2 applies the Law to processing personal data by electronic or other means, including through a non-automated platform, by a data controller, data processor or third party established or residing in Rwanda, and to any such person outside Rwanda who processes the personal data of a data subject located in Rwanda.

Article 4 requires a written contract between a data controller and a data processor before the processor may process personal data on the controller's behalf, and article 46 lists eight grounds, led by consent, on which processing personal data is lawful.

Article 6 requires the data subject's consent to be demonstrated where consent is the ground for processing, requires that consent to follow the data subject's free and informed decision, and permits it in oral, written or electronic form, and article 8 lets the data subject withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Article 13 relieves a controller or processor of any duty to acquire identifying information solely to comply with this Law where its processing purpose does not require identification, and articles 14 and 15 require personal data collected from someone other than the data subject to meet one of four listed grounds and require all personal data to be kept complete, accurate, current and not misleading.

Articles 16 and 17 require the data controller or processor to log data collection, alteration, access, disclosure, combination and erasure, and to maintain a record of all processing activities, both producible to the supervisory authority on request.

Articles 29 to 36 require registration as a data controller or data processor with the supervisory authority before processing personal data, govern the registration certificate's issuance, renewal, modification and cancellation, and require the supervisory authority to keep a public register.

Article 37 carries the lawfulness, purpose limitation, accuracy and storage limitation principles, article 38 requires appropriate technical and organisational measures, a record of processing, and a data protection impact assessment before high-risk processing such as large-scale processing of sensitive personal data or systematic monitoring of a publicly accessible area, and article 39 requires a data controller or processor with no establishment or residence in Rwanda to designate a representative there.

Article 40 requires designation of a data protection officer where the controller or processor is a public or private corporate body, carries out large-scale systematic monitoring, or processes sensitive personal data or criminal-conviction data on a large scale, and article 41 sets the officer's duties. Article 47 requires appropriate technical measures against loss, damage or destruction of personal data, regularly verified and kept updated against new risks.

Article 52 limits retention of personal data to the purpose for which it was collected unless a listed ground, such as a legal obligation, a court order or the data subject's consent, extends it, and requires destruction in a manner that prevents reconstruction once the retention period ends.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 24 October 2026.