Law No. 058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy was published, on 15 October 2021, in the Rwanda Official Gazette ('the Law'). In particular, the Law establishes among others, the following principles: lawfulness, fairness and transparency, purpose limitation and accuracy. In addition, the Law establishes among others, the following obligations: maintaining records of processed persona data, designation of a personal data protection officer, carrying out personal data protection impact assessments, provision of information during personal data collection, notification of personal data breach and communication of it to data subjects, and the implementation of appropriate technical and organisational measures to ensure security of personal data. Furthermore, the Law outlines several data subject rights which include, among others, consent and right to withdraw consent, right to personal data, right to object, right to personal data portability, right not to be subject to a decision based on automated processing, right to restriction of processing of personal data, right to erasure of personal data and right to rectification.

Moreover, the Law provides for administrative fines on data controllers, data processors or third parties who commit a misconduct of not less RWF 2,000,000 (approx. €1,500) but not more than RWF 5,000,000 (approx. €4,243) or 1% of the global turnover of the preceding financial year, or in the event of a corporate body or a legal entity, he or she is liable to 1% of the global turnover. Furthermore, the Law provides for a transition period and states that the data controller or the data processor who is already in operation has a period not exceeding two years from the date of publication of this Law in the Official Gazette of the Republic of Rwanda to conform his or her operations to the provisions of this Law.

The Law entered into effect upon its publication in the Official Gazette. 

You can read the Law here.