Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 4

Authorisation to process personal data

The processing of personal data carried out by the data processor is governed by a written contract between the data processor and the data controller.

The data processor processes personal data on behalf of the data controller subject to a written contract referred to in Paragraph One of this Article.

The data controller authorises the data processor who provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing meets the requirements of this Law.