CevroRwanda: Rwanda DPL and what it requires
Law No. 058/2021 on the Protection of Personal Data and Privacy: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by National Cyber Security Authority (NCSA).
Key requirements at a glance
| Registration with the regulator | Required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | Within 48 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Depends on thresholds or circumstances |
Penalties and enforcement
Administrative and criminal penalties apply under the Law; amounts were not verified in this review, so confirm them with local counsel.
What to know in practice
Applies to controllers and processors outside Rwanda that process data of people in Rwanda, who must designate a representative in Rwanda. Notify the NCSA within 48 hours of becoming aware of a breach (processors notify the controller within 48 hours). Personal data is generally to be stored in Rwanda unless the NCSA authorises otherwise. The article containing the security duty was not verified, so no technical-control citation is recorded.
How Cevro helps
- Maps Rwanda DPL to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Rwanda?
National Cyber Security Authority (NCSA) oversees Law No. 058/2021 on the Protection of Personal Data and Privacy.
Is breach notification mandatory under Rwanda DPL?
The law sets a 48-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Rwanda restrict cross-border data transfers?
Yes. Moving personal data out of Rwanda is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Rwanda DPL?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in Rwanda?
Administrative and criminal penalties apply under the Law; amounts were not verified in this review, so confirm them with local counsel.