Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 16

Personal data logging

The data controller or the data processor ensures personal data logging at least on the following data operations:

  1. data collected
  2. data altered
  3. data accessed
  4. data disclosed including data sharing and transfer
  5. combined data
  6. erased data

Personal data logging must indicate justification, date and time of such operations and, where possible, the contact details of the person who accessed or disclosed the personal data, as well as the contact details of the recipients of the data.

The supervisory authority may require the data controller or the data processor to provide access to the personal data logging so as to verify the lawfulness of the personal data processing.