Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 37

Principles relating to processing of personal data

The data controller and the data processor ensure that the data subject’s personal data:

  1. are processed lawfully, fairly and in a transparent manner;
  2. are collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes;
  3. are related to the purposes for which their processing was requested;
  4. are accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data are erased or rectified without delay;
  5. are kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
  6. are processed in compliance with the rights of data subjects.