Rwanda DPL 42: Lawful purpose of collection and information to be provided at collection

The controller collects personal data only for a lawful purpose connected to its activity and only where necessary for that purpose, and informs the data subject of its identity and contact details; the purposes; the recipients; whether providing the data is voluntary or mandatory; the right to withdraw consent at any time without affecting prior lawfulness; the rights of access, rectification, restriction, erasure and objection; the existence of automated decision-making including profiling, the logic involved and its significance and consequences; the storage period; the right to appeal to the supervisory authority; where applicable that data may be transferred outside Rwanda with assurance of its security; and any further information needed for fair processing. The information need not be given where the data subject already has it, where provision is impossible or disproportionate, or where recording or disclosure is provided for by law.