Support Centre

Rwanda: Chamber of Deputies adopts draft data protection law

The Chamber of Deputies announced on Twitter, on 6 May 2021, that it had adopted the relevance of the draft Law relating to Personal Data Protection and Privacy, following the draft law's approval from the Cabinet on 26 October 2020. In particular, the draft law applies to the processing of personal data by electronic or other means of processing personal data and provides grounds for collecting and processing personal data, safeguards required for processing of personal data including sensitive data, and the general rules applicable for collecting and processing personal data. 

Furthermore, the draft law provides for various data subject rights and obligations for data controllers and processors, including a requirement for data controllers to notify data breaches to the National Cyber Security Authority, which the draft law envisages as the main supervisory authority, within 24 hours, and additionally submit a report within 72 hours with all available facts. In cases of non-compliance, the draft law lists various types of violations, providing for penalties of up to RWF 10 million (approx. €8,400) or 5% of annual turnover in the case of legal entities, and terms of imprisonment of up to five years, for the most serious violations.

Ethan Mudavanhu, Tech Law Advisor at Endcode, further highlighted "the draft law's introduction of Data Embassies for storage of certain categories of personal data, rights of heirs, and the role of sectoral regulators" as particularly noteworthy provisions. Mudavanhu added that the development was a "significant step" towards Rwanda enacting data protection legislation, but outlined that the draft law still requires further approval, noting that "the next legislative steps will include passing through Rwanda's Parliamentary Commission and Plenary Session, before passing into law." 

Finally, the draft law provides that data controllers and processors who are already in operation have a period of one year from the date of publication of the draft law in the Official Gazette of the Republic of Rwanda to conform their practice to the provisions of the draft law, which will enter into effect upon publication in the Official Gazette. 

You can read the announcement here and the draft law here