Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 19

Right to object

The data subject, at any time in writing or electronically, may request the data controller or the data processor to stop processing his or her personal data which causes or is likely to cause loss, sadness or anxiety to the data subject.

However, this right does not apply if the data controller or the data processor demonstrates compelling legitimate grounds for the personnel data processing, which override the interests, rights and freedoms of the data subject or for the establishment of the legal claim.

The data subject, at any time in writing or electronically, may request the data controller or the data processor to stop processing personal data of the data subject if personal data are processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

The data controller or the data processor, within thirty (30) days from the date of receipt of the request, must inform the concerned data subject in writing or electronically of the compliance with the request or reasons for non-compliance.

The data subject who is not satisfied with the response of the data controller or the data processor may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.