Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 49

Contract for transfer of personal data

The data controller or the data processor who authorises a person to access personal data, share or transfer them to a third party outside Rwanda, enters into a written contract with such a person setting out the respective roles and responsibilities of each party to ensure compliance with this Law.

The supervisory authority may, by a regulation, determine the form of the contract to be used for transfers of personal data outside Rwanda.

Provisions of Items 1° and 3° a), b) and d) of Article 48 of this Law do not apply to activities carried out by a public body in the exercise of its functions.

The supervisory authority may require the data controller or the data processor to demonstrate their compliance with the provisions of this Article, and in particular, with personal data security safeguards and interests referred to in Item 3° f) of Article 48 of this Law.

The supervisory authority, in order to protect the rights and freedoms of the data subject, may prohibit or suspend the transfer of personal data outside Rwanda.