Know your rights to privacy – when you are requested for your personal data

As guaranteed by Rwanda’s law on personal data protection and privacy, every citizen has agency over their personal data. Data subjects have the right to choose how and why their personal data is processed and collected.

Whenever you are requested to provide your personal data, the Data Controller MUST inform you of:

• his or her identity and contact details;
• the purposes for which personal data are collected; recipients of such personal data;
• whether the data subject has the right to provide personal data voluntarily or mandatorily;
• the existence of the right to withdraw consent at any time and that such withdrawal does not affect the lawfulness of
• the processing of personal data based on consent before its withdrawal;
• the existence of the right to request from the data controller access and rectification, restriction or erasure of
• personal data concerning the data subject or to object to the processing of the data;
• the existence of automated decision making, including profiling, and information about the logic involved, as well as
• the significance and the envisaged consequences of such processing personal data for the data subject;
• the period for which personal data will be stored;
• the right to appeal to the supervisory authority;
• where applicable, that he or she can transfer personal data outside Rwanda and he or she assures him or her of their security;
• any further information likely to guarantee fair processing of the personal data, having regard to the specific
• circumstances in which the data are collected.

Reference is made to article 42 under Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy ‘Information to be provided during personal data collection.

For any further information, please contact the Data Protection & Privacy Office through toll-free number 9080, or through email at dpp@dpo.gov.rw.