Rwanda’s law on the protection of personal data and privacy (DPP Law)

The data controller, the data processor or a third party who commits one of the following misconducts:

1. failure to maintain records of processed personal data;

2. failure to carry out personal data logging;

3. operating without a registration certificate;

4. failure to report a change after receiving a registration certificate;

5. using a certificate whose term of validity has expired;

6. failure to designate a personal data protection officer;

7. failure to notify a personal data breach;

8. failure to make a report on personal data breach;

9. failure to communicate a personal data breach to the data subject;

commits a misconduct.

He or she is liable to an administrative fine of not less than two million Rwandan francs (RWF 2,000,000) but not more than five million Rwandan francs (RWF 5,000,000) or one percent (1%) of the global turnover of the preceding financial year.

The data controller, the data processor or a third party who is not satisfied with administrative sanction taken against him or her has the right to file an application to the competent court.

The administrative fine imposed by the supervisory authority is deposited to the Public Treasury.

A person who accesses, collects, uses, offers, shares, transfers or discloses personal data in a way that is contrary to this Law, commits an offence.

Upon conviction, he or she is liable to an imprisonment of not less than one (1) year but not more than three (3) years and a fine of not less than seven million Rwandan francs (RWF 7,000,000) but not more than ten million Rwandan francs (RWF 10,000,000) or one of these penalties.

Any person who knowingly, intentionally or recklessly:

1. re-identifies personal data which have been de-identified by a data controller or a data processor;

2. re-identifies and processes personal data, without consent of the data controller;
   commits an offence

Upon conviction, he or she is liable to an imprisonment of not less than one (1) year but not exceeding three (3) years and a fine of not less than seven million Rwandan francs (RWF 7,000,000) but not more than ten million Rwandan francs (RWF 10,000,000) or one of these penalties.

A person who destroys, erases, conceals or alters personal data in a way that is contrary to this Law, commits an offence.

Upon conviction, he or she is liable to an imprisonment of not less than three (3) years but not more than five (5) years and a fine of not less than seven million Rwandan francs (RWF 7,000,000) but not more than ten million Rwandan francs (RWF 10,000,000) or one of these penalties.

A person who sells personal data in a way that is contrary to this Law, commits an offence.

Upon conviction, he or she is liable to an imprisonment of not less than five (5) years but not more than seven (7) years and a fine of not less than twelve million Rwandan francs (RWF 12,000,000) but not more than fifteen million Rwandan francs (RWF 15,000,000) or one of these penalties

A person who collects or processes sensitive personal data in a way that is contrary to this Law, commits an offence.

Upon conviction, he or she is liable to an imprisonment of not less than seven (7) years but not more than ten (10) years and a fine of not less than twenty million Rwandan francs (RWF 20,000,000) but not more than twentyfive million Rwandan francs (RWF 25,000,000) or one of these penalties.

A person who provides false information during and after registration, commits an offence.

Upon conviction, he or she is liable to an imprisonment of not less than one (1) year but not more than three (3) years and a fine of not less than three million Rwandan francs (RWF 3,000,000) but not more than five million Rwandan francs (RWF 5,000,000) or one of these penalties.

A corporate body or a legal entity that commits one of the offences referred to in Articles 56, 57, 58, 59, 60 and 61 commits an offence.

Upon conviction, it is liable to a fine of Rwandan francs amounting to five percent (5%) of its annual turnover of the previous financial year.