Rwanda DPL

Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy, in force since 15 October 2021 and supervised by the National Cyber Security Agency: extraterritorial scope; written processor contracts; valid, withdrawable consent and parental consent under sixteen; grounds and safeguards for sensitive data; direct collection, data quality, mandatory personal data logging and records of processing; the rights of access, objection including to direct marketing, portability, freedom from solely automated decisions, restriction, erasure, rectification, heirs and representation, each with a 30-day response and appeal to the authority; mandatory registration of every controller and processor with a certificate lifecycle; processing principles, DPIAs on five triggers, a representative for foreign entities, a data protection officer for every legal entity, an eleven-item collection notice, breach notification to the authority within 48 hours and a report within 72 hours, communication to data subjects, eight lawful grounds, risk-based security; transfers outside Rwanda on authorisation, consent or listed grounds under a written contract; storage in Rwanda unless the certificate authorises otherwise; retention limited to purpose with irreversible destruction. Administrative fines of RWF 2 to 5 million or one percent of global turnover, offences with imprisonment and fines up to RWF 25 million, corporate fines of five percent of turnover.