Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 43

Notification of personal data breach

In case of personal data breach, the data controller, within forty-eight (48) hours after being aware of the incident, must communicate the personal data breach to the supervisory authority.

Where the data processor becomes aware of personal data breach, he or she notifies the data controller within forty-eight (48) hours after being aware of the incident.