Rwanda’s law on the protection of personal data and privacy (DPP Law)
DPP Law Table of contents
-
Art. 4 - Authorization to
process personal data
Art. 5 - Privacy of the data
subject
Art. 6 - Consent of the data
subject
Art. 7 - Indication of other
matters in the declaration of consent
Art. 8 - Right of the data
subject to withdraw his or her consent
Art. 9 - Processing a child’s
personal data
Art. 10 - Grounds for
processing sensitive personal data
Art. 11 - Safeguards to
process sensitive personal data
Art. 12 - Processing personal
data of a convict
Art. 13 - Processing of
personal data which does not require data subject’s identification
Art. 14 - Source of personal
data
Art. 15 - Quality of personal
data
Art. 16 - Personal data
logging
Art. 17 - Maintaining records
of processed personal data
-
Art. 18 - Right to personal
data
Art. 19 - Right to
object
Art. 20 - Right to personal
data portability
Art. 21 - Right not to be
subject to a decision based on automated data processing
Art. 22 - Right to
restriction of processing of personal data
Art. 23 - Right to erasure of
personal data
Art. 24 - Right to
rectification
Art. 25 - Right to designate
an heir to personal data
Art. 26 - Right to
representation
-
Art. 29 - Registration as a
data controller or a data processor
Art. 30 - Requirements for
registration as a data controller or a data processor
Art. 31 - Issuance of a
registration certificate
Art. 32 - Reporting a change
after receiving a registration certificate
Art. 33 - Renewal of a
registration certificate
Art. 34 - Modification of a
registration certificate
Art. 35 - Cancellation of a
registration certificate
Art. 36 - Register of data
controllers and data processors
-
Art. 37 - Principles relating
to processing of personal data
Art. 38 - Duties of the data
controller and the data processor
Art. 39 - Designation of a
representative of the data controller or the data processor
Art. 40 - Designation of the
personal data protection officer
Art. 41 - Duties of the
personal data protection officer
Art. 42 - Information to be
provided during personal data collection
Art. 43 - Notification of
personal data breach
Art. 44 - Report on personal
data breach
Art. 45 - Communication of a
personal data breach to the data subject
Art. 46 - Lawful processing
of personal data
Art. 47 - Measures to ensure
security of personal data
-
Art. 53 - Administrative
misconducts
Art. 54 - Filing an
application to the court
Art. 55 - Place where the
administrative fine is deposited
Art. 56 - Accessing,
collecting, using,offering, sharing, transfer or disclosing of personal
data in a way that is contrary to this Law
Art. 57 - Re-identification
of de-identified personal data in a way that is contrary to this
Law
Art. 58 - Destruction,
erasure, concealment or alteration of personal data in a way that is
contrary to this La
Art. 59 - Sale of personal
data in a way that is contrary to this Law
Art. 60 - Collecting or
processing of sensitive personal data in a way that is contrary to this
Law
Art. 61 - Providing false
information
Art. 62 - Punishment of a
corporate body or a legal entity
Art. 63 - Additional
penalties
DPP Law
On October 15, 2021, Law No 058/2021 of 13/10/2021 relating to the protection of personal data and privacy was officially gazetted. This law protects personal data and ensures privacy of individuals in Rwanda.
One of the tenets of this law is the clear and unambiguous consent of an individual to the collection, storage, and processing of personal data, which is a fundamental right.
The law now brings Rwanda in line with international data protection standards, vital for modern digital economy facilitating services such as e-commerce, international financial transactions, and various online services.
The primary goals of this law are to:
- Empower citizens with the agency over their personal data
- Enable trusted and secure data flow, domestically and internationally
- Provide regulatory certainty for existing businesses and prospective investors, and an enabling environment for SME growth
- Accelerate Rwanda’s ambitions toward a technology-enabled and data-driven economy
The DPP Law page is provided to you as a helpful resource to quickly find all 70 articles. Here you can find the official PDF of Law No 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.