Rwanda’s law on the protection of personal data and privacy (DPP Law)

DPP Law Table of contents

Art. 9

Processing a child’s personal data

Where the data controller, the data processor or a third party knows that personal data belong to a child under the age of sixteen (16) years, he or she must obtain the consent of a holder of parental responsibility over the child in accordance with relevant laws.

Subject to the provisions of other Laws, the consent obtained on behalf of the child is acceptable only if it is given in the interest of the child.

However, the consent is not required to process the child’s personal data if it is necessary for protecting the vital interest of the child.