Law: The Law No. 058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy ('the Data Protection Law')

Regulator: The National Cyber Security Authority

Summary: The Data Protection Law was published, on 15 October 2021, in the Rwanda Official Gazette. The Data Protection Law introduces principles related to lawfulness, fairness and transparency, purpose limitation and accuracy, and obligations related to data subject rights, registration as a data controller or data processor, pseudonymisation, sensitive data, data transfers, designation of a data protection officer, Data Protection Impact Assessments, and data breach notifications. In addition, the Data Protection Law provides for administrative fines on data controllers, data processors and third parties who commit misconduct of not less than RWF 2 million (approx. €1,500) but not more than RWF 5 million (approx. €4,240) or 1% of the global turnover.