Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 45

Communication of a personal data breach to the data subject

Where the personal data breach is likely to result in a high risk to the rights and freedoms of the data subject, the data controller communicates the personal data breach to the data subject in writing or electronically, after having become aware of it.

However, the data controller is not required to communicate the personal data breach to the data subject if:

  1. the data controller has implemented appropriate technical and organisational protection measures in relation to personal data breached such that the personal data breach is unlikely to result in a high risk to the rights and freedoms of the data subject;
  2. the data controller has taken measures which ensure that the high risk to the rights and freedoms of the data subject is no longer likely to materialize;
  3. the data controller communicated it to the public whereby the data subject is informed in an equally effective manner.

If the data controller has not communicated the personal data breach to the data subject, and the personal data breach is likely to result in a high risk to the rights and freedoms of the data subject, the supervisory authority may request the data controller to communicate the personal data breach to the data subject in writing or electronically.