The data controller collects personal data for a lawful purpose connected to the activity of the data controller and when the data is necessary for that purpose.

The data controller who collects personal data informs the data subject of the following:

1. his or her identity and contact details;
2. the purposes for which personal data are collected;
3. recipients of such personal data;
4. whether the data subject has the right to provide personal data voluntarily or mandatorily;
5. the existence of the right to withdraw consent at any time and that such withdrawal does not affect the lawfulness of the processing of personal data based on consent before its withdrawal;
6. the existence of the right to request from the data controller access and rectification, restriction or erasure of personal data concerning the data subject or to object to the processing of the data;
7. the existence of automated decision making, including profiling, and information about the logic involved, as well as the significance and the envisaged consequences of such processing personal data for the data subject;
8. ° the period for which personal data will be stored;
9. the right to appeal to the supervisory authority;
10. °where applicable, that he or she can transfer personal data outside Rwanda and he or she assures him or her of their security;
11. any further information likely to guarantee fair processing of the personal data, having regard to the specific circumstances in which the data are collected.

However, the data controller is not requiredto comply with the provisions of Paragraph 2 of this Article if:

1. the data subject already has the information referred to in Paragraph One of this Article;
2. the provision of such information proves impossible or involves a disproportionate effort;
3. the recording or disclosure of the personal data is provided for by the Law.