Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 10

Grounds for processing sensitive personal data

The data controller or the data processor processes sensitive personal data only if:

  1. the processing is based on the data subject’s consent;
  2. the processing is necessary for the purposes of carrying out the obligations of the data controller, of the data processor or exercising specific rights of the data subject in accordance with relevant Laws;
  3. the processing is necessary to protect the vital interests of the data subject or of any other person;
  4. the processing is necessary for the purposes of preventive or occupational medicine, public health such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices;
  5. the processing is necessary for archiving purposes in the public interest or scientific and historical research purposes or statistical purposes.