Rwanda’s law on the protection of personal data and privacy (DPP Law)

Without prejudice to other relevant Laws, the data subject may, in writing or electronically, request from the data controller or the data processor the following:

1. to provide him or her with the information relating to the purposes of the processing of personal data;

2. to provide him or her with a copy of personal data;

3. to provide him or her with a description of personal data that the data controller or the data processor holds, including data on the contact details of a third party or the categories of third parties who have or had access to personal data;

4. to inform him or her of the source of the personal data in case his or her personal data have not been obtained from the data subject;

5. to inform him or her in case his or her personal data have been transferred to a third country or to an international organisation.

The right referred to in Item 2° of Paragraph One of this Article is not exercised if:

1. it may adversely affect the rights and freedoms of other persons;

2. legal professional privilege or another legal obligation of confidentiality applies;

3. the data relates to information management or information about the data subject or relates to ongoing negotiations with the data subject requester;

4. the data relates to the data subject’s confidential references, examination scripts or examination marks.

The data controller or the data processor must provide the data subject with his or her personal data in a clear and concise manner.

The data subject who is not satisfied with the response of the data controller or the data processor may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.

The data subject, at any time in writing or electronically, may request the data controller or the data processor to stop processing his or her personal data which causes or is likely to cause loss, sadness or anxiety to the data subject.

However, this right does not apply if the data controller or the data processor demonstrates compelling legitimate grounds for the personnel data processing, which override the interests, rights and freedoms of the data subject or for the establishment of the legal claim.

The data subject, at any time in writing or electronically, may request the data controller or the data processor to stop processing personal data of the data subject if personal data are processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

The data controller or the data processor, within thirty (30) days from the date of receipt of the request, must inform the concerned data subject in writing or electronically of the compliance with the request or reasons for non-compliance.

The data subject who is not satisfied with the response of the data controller or the data processor may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.

The data subject has the right to request the data controller in writing or electronically to resend the personal data concerning him or her as it was provided to the data controller, in a structured and readable format.

The data subject also has the right to request the data controller in writing or electronically to have his or her personal data transmitted to another data controller, where technically feasible, without hindrance.

The data controller, within thirty (30) days from the date of receipt of the request, must inform the concerned data subject in writing or electronically of personal data portability.

The data subject who is not satisfied with the response of the data controller may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.

The data subject has the right not to be subject to a decision based solely on automated personal data processing, including profiling, which may produce legal consequences or significant consequences to him or her.

However, the provisions of Paragraph One of this Article do not apply if the decision:

1. is based on the data subject’s explicit consent;

2. is necessary for entering into, or performance of, a contract between the data subject and the data controller;

3. is authorised by Laws to which the data controller is subject and also puts in place suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests.

Any automated processing of personal data intended to evaluate certain personal aspects relating to a natural person does not base on sensitive personal data unless one of the grounds set out in Article 10 of this Law is met.

The data subject or the supervisory authority has the right to restrict the data controller from processing personal data for a given period if:

1. the accuracy of personal data is contested by the data subject, pending the verification of their accuracy;

2. the processing is unlawful and the data subject requests the erasure of the personal data or the restriction of the use of some of them;
   the data subject has objected to the processing of personal data pending the verification whether the legitimate grounds of the controller override those of the data subject.

The right to restriction of processing of personal data described in Paragraph One of this Article is not exercised if the processing of personal data:

1. is necessary for the protection of the rights of another person;

2. is necessary for reasons of public interest.

The data controller must, before lifting the restriction of processing of personal data referred to in item 1o of Paragraph 2 of this Article, inform the data subject in writing or electronically.

The data subject has the right to request the data controller in writing or electronically for erasure of his or her personal data where:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or processed;

2. the data subject withdraws consent on which the personal data processing is based and where there is no other legal ground for the processing;

3. the data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing;
   the personal data have been unlawfully processed.

The data controller who has disclosed personal data to a third party or has posted the personal data in the public domain must, in writing or electronically, inform a third party processing such data that the data subject has requested the erasure of any links to, or copy of, those personal data.

However, the right to request the erasure of personal data does not apply to the extent that processing is necessary:

1. for reasons of public interest;

2. for historical or scientific research purposes or statistical purposes;

3. for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;

4. for the establishment, exercise or defence of legal claims in the interest of the data controller.

The data controller, within thirty (30) days from the date of receipt of the request, must inform the concerned data subject in writing or electronically of the erasure of his or her personal data.

The data subject who is not satisfied with the response of the data controller may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.

The data subject has the right to request the data controller the rectification of his or her personal data.

The data subject has the right to have incomplete personal data completed, where necessary.

The data controller, within thirty (30) days from the date of receipt of the request, must inform the data subject in writing or electronically of the rectification of his or her personal data.

The data subject who is not satisfied with the response of the data controller may appeal to the supervisory authority within thirty (30) days from the date of receipt of the response.

If the data subject appeals, the supervisory authority responds to his or her appeal within sixty (60) days from the date of receipt of the appeal.

The personal data of the data subject are not subject to succession.

However, where the data subject had left a will, the data subject provides his or her heir with full or restricted rights relating to the processing of personal data kept by the data controller or the data processor, if such personal data still need to be used.