Rwanda

Article 43 requires the data controller, within forty-eight hours of becoming aware of a personal data breach, to notify it to the supervisory authority, and requires a data processor who becomes aware of a breach to notify the data controller within the same forty-eight hours.

Article 44 requires the data controller to submit a full report to the supervisory authority no later than seventy-two hours after becoming aware of the breach, describing its nature, the affected categories and approximate numbers of data subjects and records, the data protection officer's or other contact point's details, the measures taken or proposed to address it and mitigate its effects, and a proposal and timeline for communicating it to affected data subjects.

Article 45 requires the data controller to communicate a breach likely to result in a high risk to a data subject's rights and freedoms to that data subject, in writing or electronically, after becoming aware of it, but sets no separate deadline for that communication, and excuses it where the data was already protected by measures such as encryption, the high risk is no longer likely to materialize, or an equally effective public communication was made instead; the supervisory authority may still require the communication to be made.

Article 2 applies the Law to processing personal data by electronic or other means, including through a non-automated platform, by a data controller, data processor or third party established or residing in Rwanda, and to any such person outside Rwanda who processes the personal data of a data subject located in Rwanda.

Article 4 requires a written contract between a data controller and a data processor before the processor may process personal data on the controller's behalf, and article 46 lists eight grounds, led by consent, on which processing personal data is lawful.

Article 6 requires the data subject's consent to be demonstrated where consent is the ground for processing, requires that consent to follow the data subject's free and informed decision, and permits it in oral, written or electronic form, and article 8 lets the data subject withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Article 13 relieves a controller or processor of any duty to acquire identifying information solely to comply with this Law where its processing purpose does not require identification, and articles 14 and 15 require personal data collected from someone other than the data subject to meet one of four listed grounds and require all personal data to be kept complete, accurate, current and not misleading.

Articles 16 and 17 require the data controller or processor to log data collection, alteration, access, disclosure, combination and erasure, and to maintain a record of all processing activities, both producible to the supervisory authority on request.

Articles 29 to 36 require registration as a data controller or data processor with the supervisory authority before processing personal data, govern the registration certificate's issuance, renewal, modification and cancellation, and require the supervisory authority to keep a public register.

Article 37 carries the lawfulness, purpose limitation, accuracy and storage limitation principles, article 38 requires appropriate technical and organisational measures, a record of processing, and a data protection impact assessment before high-risk processing such as large-scale processing of sensitive personal data or systematic monitoring of a publicly accessible area, and article 39 requires a data controller or processor with no establishment or residence in Rwanda to designate a representative there.

Article 40 requires designation of a data protection officer where the controller or processor is a public or private corporate body, carries out large-scale systematic monitoring, or processes sensitive personal data or criminal-conviction data on a large scale, and article 41 sets the officer's duties. Article 47 requires appropriate technical measures against loss, damage or destruction of personal data, regularly verified and kept updated against new risks.

Article 52 limits retention of personal data to the purpose for which it was collected unless a listed ground, such as a legal obligation, a court order or the data subject's consent, extends it, and requires destruction in a manner that prevents reconstruction once the retention period ends.

Article 48 permits a data controller or data processor to share or transfer personal data to a third party outside Rwanda only on a listed ground: the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, contractual necessity, public interest, the establishment or defence of a legal claim, protecting a vital interest, the controller's or processor's own compelling legitimate interests where the transfer is not repetitive and safeguards have been assessed, or performance of an international instrument Rwanda has ratified.

Article 49 requires a written contract with anyone authorised to access, share or transfer personal data outside Rwanda, and lets the supervisory authority demand proof of compliance or prohibit or suspend a transfer to protect data subjects' rights. Article 50 requires personal data to be stored in Rwanda, permitting storage abroad only where the controller or processor holds a valid registration certificate from the supervisory authority authorising it.

Article 21 gives the data subject the right not to be subject to a decision based solely on automated personal data processing, including profiling, that may produce legal or other significant consequences for them. That right does not apply where the decision rests on the data subject's explicit consent, is necessary to enter into or perform a contract, or is authorised by a law that also puts in place suitable measures to safeguard the data subject's rights, freedoms and legitimate interests.

Automated processing intended to evaluate personal aspects of a natural person must not rest on sensitive personal data unless a ground listed in Article 10 applies.

Articles 18 to 26 give the data subject rights of access, objection, portability, rectification, erasure, and restriction of processing. Article 22 lets the data subject or the supervisory authority restrict processing while accuracy, lawfulness, or an objection is being resolved, article 25 excludes personal data from succession except by will, and article 26 lets a minor, a person with a physical or mental impairment, or anyone else designate a representative to exercise these rights.

A data subject dissatisfied with a controller's or processor's response to an objection, portability, erasure, or rectification request may appeal to the supervisory authority within thirty days, which must answer the appeal within sixty days.

Article 42 requires the data controller, when collecting personal data, to give the data subject an information notice covering identity and contact details, the purposes and recipients of processing, whether provision of the data is mandatory, the existence and consequences of automated decision making, the retention period, and the rights this Law gives the data subject, including the right to withdraw consent and to appeal to the supervisory authority.

Article 27 tasks the supervisory authority with overseeing the Law's implementation, responding to requests for an opinion, informing data subjects, controllers, processors and third parties of their rights and obligations, keeping the register of data controllers and processors, investigating and deciding complaints, and cooperating with domestic and foreign counterparts, and article 28 gives it the power to issue registration certificates, ensure compliance, protect public freedoms and privacy from information and communication technologies, make regulations, and impose administrative sanctions.

Article 53 sets an administrative fine, for an individual, of between two million and five million Rwandan francs or one percent of the preceding financial year's global turnover for listed misconducts including failure to maintain records, log processing, register, report a certificate change, designate a data protection officer, or notify, report or communicate a breach, and one percent of global turnover alone for a corporate body or legal entity, with article 54 letting anyone dissatisfied with an administrative sanction apply to the competent court and article 55 depositing the fine with the Public Treasury.

Articles 56 to 61 create separate criminal offences, each with its own imprisonment and fine range, for unlawfully accessing, using, sharing, transferring or disclosing personal data, re-identifying de-identified data, destroying, erasing, concealing or altering data, selling data, unlawfully collecting or processing sensitive personal data, and providing false registration information, article 62 fines a corporate body or legal entity convicted of any of those offences five percent of its preceding financial year's annual turnover, and article 63 lets the court order seizure or confiscation of items and proceeds and the permanent or temporary closure of the offending entity or premises.

Article 64 makes the supervisory authority the organ that settles conflicts arising under this Law in the first instance, subject to a party's right to take an unresolved conflict to a competent court, and article 65 gives a person who suffers serious damage from a controller's or processor's violation of this Law the right to claim compensation before a competent court, unless the controller or processor proves it was not responsible for the damage.

Article 9 requires the consent of a holder of parental responsibility before processing personal data belonging to a child under sixteen, permits that consent only where given in the child's interest, and dispenses with it where processing is necessary to protect the child's vital interest.

Article 10 permits processing sensitive personal data, defined at article 3 to include race, health status, criminal records, medical records, social origin, religious or philosophical beliefs, political opinion, genetic or biometric information, sexual life and family details, only on the data subject's consent, the controller's or processor's legal obligations, a vital interest, public health, or archiving, scientific, historical or statistical purposes.

Article 11 layers safeguards onto that processing: compliance with the sensitive-data retention periods this Law sets, staff-capacity building, controls on who may access it, and technical and organisational measures appropriate to the risk, including storing it separately from other data and applying tokenisation, pseudonymisation or encryption.

Article 12 places processing personal data of a convict, whose criminal record is itself a category of sensitive personal data, under the supervisory authority's supervision, and requires safeguards for that data subject's rights and freedoms.

Article 16 makes it an offence for a person to intentionally and unlawfully get access to computer or computer system data where the person does not have consent from someone entitled to give it, is not entitled to control or access the data, or accesses another person's computer system without authorization to know recorded or transmitted data, by any means and regardless of location. The offence carries imprisonment of six months to two years and a fine of RWF 1,000,000 to 2,000,000.

None of article 16's three grounds requires infringing a technical security measure; each turns instead on the absence of consent, entitlement, or authorization.

Article 125 of Law N° 24/2016 requires an electronic communications network or service provider to take all technical and organizational measures necessary to ensure that the services and associated electronic communications networks are fully secured. Article 208 requires a provider of public electronic communications services, in conjunction with a provider of electronic networks services, to take appropriate measures to safeguard the security of those services and networks.

Article 207 provides that the Minister establishes a Ministerial Order relating to cyber security. Article 15 gives the Regulatory Authority the power to monitor the activities of licensed operators and impose administrative sanctions on them. The Law comes into force on the date of its publication in the Official Gazette of the Republic of Rwanda (article 310). The Law was published in Official Gazette 26 of 27 June 2016.

Article 28(1) of the Law requires a virtual asset service provider to implement effective systems, processes, controls, policies and procedures to handle risks, including cyber security-related risks to its business and virtual asset activities, and the safety of virtual assets and customer information.

Article 28(2) requires the provider's technology risk management framework to address the risks associated with the generation of cryptographic keys or virtual asset wallets, the signing and approval of transactions, and the storage of cryptographic keys and seed phrases. Article 28(3) requires the provider to establish and maintain sound operational standards, including robust cybersecurity measures.

Article 28(4) requires the provider to keep its operations running without interruption by maintaining backup infrastructure and a disaster recovery and business continuity plan and by periodically testing them. Article 28(5) requires the provider's technology and information security framework to be periodically audited and verified by an independent and qualified auditor. The Regulatory Authority is the Capital Market Authority of Rwanda.

The Law comes into force on the date of its publication in the Official Gazette. That publication is the Special issue of 28 May 2026.

The National Bank of Rwanda, called the Supervisory Authority in the text, issues the Regulation. Article 2 applies the Regulation to all regulated institutions unless specific regulations or directives provide otherwise. Article 3 defines a regulated institution as any financial institution licensed and supervised by the Supervisory Authority. Article 4 makes cyber security governance the responsibility of the Board of Directors and Senior Management.

Article 9 requires a regulated institution to implement and maintain a written cyber security policy that is approved by the board and based on its risk assessment. Article 10 requires a regulated institution to conduct at least annual penetration tests and bi-annual vulnerability assessments. Article 10 also requires the regulated institution to share with the Supervisory Authority an executive summary of the findings of the test within fifteen days after the test.

Article 16 requires multi-factor authentication for any individual accessing the regulated institution’s internal networks from an external network, unless the head of the IT security function or relevant staff has approved in writing the use of reasonably equivalent or more secure access controls. Article 19 requires a regulated institution to implement controls, including encryption, to protect data held or transmitted by it both in transit over external networks and at rest.

Article 20 requires a regulated institution to establish a written incident response management plan designed to promptly respond to, contain and recover from disruptions caused by any cyber incident materially affecting the confidentiality, integrity or availability of its information systems.

Article 22 requires a regulated institution to submit to the Supervisory Authority every year, not later than 15 January, a written statement of self-assessment certifying that its cyber security strategy complies with the Regulation. Article 25 lets the Supervisory Authority apply any sanctions available under the relevant provisions of the relevant specific regulations where a regulated institution fails to satisfy any of the requirements of the Regulation.

Article 26 gave regulated institutions that did not comply with the Regulation one year from its publication in the Official Gazette to comply. The Regulation came into force on its publication in the Official Gazette (article 29). The Regulation was published in the Official Gazette special issue of 17 June 2022.

Article 125 of Law N° 24/2016 requires a licensed electronic communications service provider to inform users about any security risks which may occur as a result of a breach of network security measures or protocols and the necessary remedies available to address the breach.

Article 208 requires a service provider, where there is a significant risk to the security of provided services, to inform the subscribers of the risk, any appropriate measures that the subscriber may take to safeguard against that risk and the likely costs to the subscriber of taking such measures. Article 208 also requires the information to be provided to the subscriber free of any charge other than the cost that the subscriber would have incurred for accessing the information.

Article 15 gives the Regulatory Authority the power to monitor the activities of licensed operators and impose administrative sanctions on them. The Law comes into force on the date of its publication in the Official Gazette of the Republic of Rwanda (article 310). The Law was published in Official Gazette 26 of 27 June 2016.

Article 21(1) of the Law requires a virtual asset service provider to notify the Regulatory Authority immediately, in writing, where it suspects or has reason to believe that a cyber-attack, including attempted events, that may affect operations and customers is likely to occur or has occurred. The same paragraph also requires immediate notice of the provider's involvement in criminal proceedings and of its opening or ceasing virtual asset business outside Rwanda.

The Regulatory Authority is the Capital Market Authority of Rwanda. The Law comes into force on the date of its publication in the Official Gazette. That publication is the Special issue of 28 May 2026.

Article 2 applies the Regulation to all regulated institutions unless specific regulations or directives provide otherwise. Article 3 defines a regulated institution as any financial institution licensed and supervised by the Supervisory Authority.

Article 3 defines a cyber incident as a cyber event that jeopardizes the cyber security of an information system or the information the system processes, stores or transmits, or that violates the security policies, security procedures or acceptable use policies, whether resulting from malicious activity or not.

Article 21 requires a regulated institution to notify the Supervisory Authority as promptly as possible, within a period not exceeding two hours from the occurrence of the incident or from a determination that a cyber security incident has occurred.

The two-hour notification covers a cyber security incident that may disrupt a regulated institution from continuing its normal operations for customer-facing transactions, and cyber security events that have a reasonable likelihood of materially harming any material part of the normal operations of the institution.

Article 21 also requires the regulated institution to submit the full incident report to the Supervisory Authority within 24 hours from the occurrence of the incident as per the annex to the Regulation. Article 21 allows specific reporting requirements on cyber security incidents to be provided in a Directive.

Appendix 1 sets the format of the cyber security incident report, which records the date and time of the incident, its type or nature, the physical location, the action taken, the time of resolution, the estimated or actual impact, the law enforcement authorities involved and the action taken to mitigate future incidents.

Article 25 lets the Supervisory Authority apply any sanctions available under the relevant provisions of the relevant specific regulations where a regulated institution fails to satisfy any of the requirements of the Regulation. The Regulation came into force on its publication in the Official Gazette (article 29). The Regulation was published in the Official Gazette special issue of 17 June 2022.

Article 3 applies these instructions to any person or organisation that broadcasts or provides content online or provides access to online content, a scope not confined to services aimed at children or to social media platforms.

Article 4 requires digital content providers and retailers to make available digital content filtering tools, maintain plans to manage harmful online content, provide a reporting function for users, give a clear external label describing whether platform content is suitable for children, and put in place a mechanism to prevent children from accessing age-inappropriate content, sites, products, or interactive services.

Article 5 requires internet service providers to inform subscribers of risks to children, support reporting of child abuse, block access to child-abuse material once identified, and make parental-control tools available where applicable. Article 6 requires cybercafes and public Wi-Fi providers in public places to proactively block access to sites known for hosting content harmful to children.

Article 7 requires broadcasters and television service providers to indicate the suitability of content for various age categories. It also requires them to implement technical barriers, including parental controls and age-verification tools, so that children are not exposed to harmful content.

Article 8 requires social media users to self-regulate by refraining from creating or publishing videos of child actors in age-inappropriate roles, and from creating or publishing children's images or videos for entertainment or commercial purposes without the consent of a holder of parental responsibility.

The instructions themselves do not define the term child; they are issued pursuant to Law N° 71/2018 relating to the Protection of the Child, which defines a child as any person under eighteen years of age.

Article 282 excludes official legislative, administrative and judicial texts, news of the day or miscellaneous facts having the character of mere items of press information, and any idea, procedure, system, method of operation, concept, principle, discovery or mere data from copyright protection, so a bare news item is never a protected work under Rwandan law, whichever outlet reports it first.

Article 297(1)(a) permits, without the author's consent and without payment of royalties, the reproduction by the press, the broadcasting or the communication to the public of an article published in newspapers or periodicals on current economic, political, social or religious topics, or of a broadcast work of the same character, where the right to reproduction, broadcasting or communication to the public is not expressly reserved.

Article 297(1)(b) permits, on the same terms, the reproduction or communication to the public, for the purpose of reporting short current events, of a work seen or heard during such an event, to the extent justified by the intended informatory purpose.

Article 297(1)(c) permits, on the same terms, the reproduction in the press, the broadcasting or other communication to the public of political speeches, lectures, addresses, sermons or other works of the same nature delivered in public, or speeches delivered during legal proceedings, to the extent justified by the purpose of providing current information. Article 297(2) requires each use under paragraph (1) to indicate the source and the name of the author as far as practicable.

Article 293 permits the use, in the form of quotation or of a short part of a published work, without the author's authorization and without payment of royalties, provided the use is compatible with fair practice and does not exceed the extent justified by the purpose. Article 293(2) requires the quotation to indicate the source and the author's name where it appears in the work quoted.