Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 21

Right not to be subject to a decision based on automated data processing

The data subject has the right not to be subject to a decision based solely on automated personal data processing, including profiling, which may produce legal consequences or significant consequences to him or her.

However, the provisions of Paragraph One of this Article do not apply if the decision:

  1. is based on the data subject’s explicit consent;
  2. is necessary for entering into, or performance of, a contract between the data subject and the data controller;
  3. is authorised by Laws to which the data controller is subject and also puts in place suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests.

Any automated processing of personal data intended to evaluate certain personal aspects relating to a natural person does not base on sensitive personal data unless one of the grounds set out in Article 10 of this Law is met.