Skip to main navigation
Skip to main content
Skip to page footer
21.
Sharing, transfer, storage and retention of personal data - Art. 50
Art. 50
The data controller or the data processor stores personal data in Rwanda.
However, the storage of personal data outside Rwanda is only permitted if the data controller or the data…
22.
Obligations of the data controller and the data processor - Art. 46
Art. 46
The data controller or the data processor lawfully processes personal data if:
the data subject has given consent to the processing of his or her personal data for purposes explained to…
23.
Obligations of the data controller and the data processor - Art. 37
Art. 37
The data controller and the data processor ensure that the data subject’s personal data:
are processed lawfully, fairly and in a transparent manner; are collected for explicit, specified…
24.
Obligations of the data controller and the data processor - Art. 38
Art. 38
In compliance with the principles of the processing of personal data, the data controller and the data processor discharge the following duties:
to implement appropriate technical and…
25.
Obligations of the data controller and the data processor - Art. 39
Art. 39
The data controller or the data processor who is neither established nor resides in Rwanda, but processes personal data of data subjects located in Rwanda, designates in writing a…
26.
Obligations of the data controller and the data processor - Art. 40
Art. 40
The data controller and the data processor designate a data protection officer where:
the processing of personal data is carried out by public or private corporate body or a legal entity,…
27.
Obligations of the data controller and the data processor - Art. 41
Art. 41
The personal data protection officer has the following duties:
to inform and advise the data controller, the data processor and the employees who carry out personal data processing, of…
28.
Obligations of the data controller and the data processor - Art. 42
Art. 42
The data controller collects personal data for a lawful purpose connected to the activity of the data controller and when the data is necessary for that purpose.
The data controller who…
29.
Obligations of the data controller and the data processor - Art. 43
Art. 43
In case of personal data breach, the data controller, within forty-eight (48) hours after being aware of the incident, must communicate the personal data breach to the supervisory…
30.
Obligations of the data controller and the data processor - Art. 44
Art. 44
The data controller draws up a report on personal data breach and submits it to the supervisory authority not later than seventytwo (72) hours, with all facts available.
The report…
