Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 27

Duties of the supervisory authority in matters relating to the protection of personal data and privacy

The supervisory authority has the following duties:

  1. to oversee the implementation of this law;
  2. to respond to every legitimate request for an opinion regarding personal data processing;
  3. to inform the data subject, the data controller, the data processor and a third party of their rights and obligations;
  4. to put in place a register of data controllers and data processors;
  5. to investigate the subject matter of the complaint lodged by the data subject, the data controller, the data processor or a third party relating to the processing of personal data and inform them of the outcome of the investigation within a reasonable period;
  6. to receive and consider the data subject’s appeal;
  7. to advise on matters relating to the protection of personal data and privacy;
  8. cooperate with authorities, organisations or entities operating within the country or abroad in the protection of personal data and privacy.