Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 60

Collecting or processing of sensitive personal data in a way that is contrary to this Law

A person who collects or processes sensitive personal data in a way that is contrary to this Law, commits an offence.

Upon conviction, he or she is liable to an imprisonment of not less than seven (7) years but not more than ten (10) years and a fine of not less than twenty million Rwandan francs (RWF 20,000,000) but not more than twentyfive million Rwandan francs (RWF 25,000,000) or one of these penalties.