It has now been almost three and a half years since the Rwandan Law No. 058/2021 of October 13, 2021, on the protection of personal data and privacy (the “Data Protection Act” or “DPA”) came into force, following a two-year grace period. Enforcement of the DPA began on October 15th, 2023, mandating compliance for all organisations that fall in the DPA’s scope of application, whether they process personal data within Rwanda or from abroad. The DPA applies to all organisations, including third parties established or residing in Rwanda who process personal data within Rwanda, as well as those who are neither established nor reside in Rwanda but process personal data of individuals located in Rwanda. Ensuring compliance is especially imperative for organisations conducting business in Rwanda and handling the personal information of Rwandans, as significant penalties may be imposed for violations. Non-compliance can result in administrative fines ranging from no less than RWF 2,000,000 (approx. USD 2,000) to no more than RWF 5,000,000 (approx. USD 5,000), or 1% of the global turnover from the preceding financial year. Rwanda's Data Protection Act, inspired by global standards such as the EU's General Data Protection Regulation (GDPR), echoes the country's devotion to creating a secure digital ecosystem. Moreover, Rwanda ratified the Convention on Cyber Security and Personal Data Protection on November 21st, 2019. This convention, adopted in Malabo, Equatorial Guinea, on 27th June 2014, also known as the Malabo Convention, requires countries to implement domestic laws for personal data protection that align with the rights-based standards outlined in the convention. The DPA provides a comprehensive framework for processing personal data, emphasising principles such as accountability, transparency, and individual rights. The DPA introduces substantial provisions aimed at protecting personal data and empowering individuals with greater control over their personal information. Key among these provisions is the recognition of data subject rights, granting individuals the ability to access their data, request corrections, withdraw consent, and object to data processing. In addition, the DPA places a strong emphasis on the responsibilities of data controllers and processors. Organisations handling personal data must demonstrate accountability by implementing comprehensive data protection measures. This includes appointing a Data Protection Officer (DPO) to oversee compliance efforts and conducting Data Protection Impact Assessments (DPIAs) to evaluate risks associated with high-risk data processing activities. The DPA also establishes stringent requirements for cross-border data transfers and the storage of personal data outside Rwanda. Personal data may only be transferred or stored outside Rwanda upon authorisation from the National Cyber Security Authority (NCSA), after providing proof of proper safeguards for the protection of personal data in the receiving jurisdiction or through other appropriate technical and organisational measures. Furthermore, the DPA emphasises the importance of compliance by introducing significant sanctions for violations. Non-compliance with DPA’s provisions can lead to substantial penalties, serving as a deterrent and reinforcing the serious need for organisations to adhere to data protection obligations. Rwanda’s Data Protection Act is not just a regulatory breakthrough; it is a foundation for trust and innovation. Compliance with the DPA assures businesses, investors, and consumers that their data is handled securely and ethically. For businesses, this translates into a competitive advantage. Organisations that comply with the DPA can differentiate themselves by exhibiting their commitment to privacy, enhancing their reputation and customer loyalty. Moreover, compliance may open doors to international partnerships and markets that prioritise stringent data protection standards like the EU, the United States, Canada, the United Kingdom, Australia, and Japan. As Rwanda observes Privacy Week from January 27th to 31st, coinciding with Data Privacy Day celebrated each year on January 28th, the focus will be firmly on building a privacy-conscious culture. This initiative, spearheaded by the National Cyber Security Authority, aims to raise awareness about data protection rights and responsibilities. Organisations are strongly encouraged to take proactive steps to ensure effective data protection and privacy within their operations. One essential approach is to educate employees by conducting training sessions that embed privacy principles into everyday workplace practices. Engaging stakeholders is another important strategy. Organisations should communicate their commitment to data protection not only through client interactions but also through public campaigns. Additionally, organisations must continuously review and enhance their internal data privacy policies. It is important to update these policies regularly to ensure they align with the latest regulations and industry best practices. Since the introduction of the Rwandan Data Protection Act, many organisations, including offshore entities conducting business in Rwanda and those involved in business relationships requiring data transfer and storage outside Rwanda, have made efforts to comply with the DPA. These efforts include putting in place both technical and organisational measures for protection of personal data, registering with NCSA as data controllers or data processors, appointing local representatives, and seeking authorisation for the sharing, transfer, and storage of personal data outside Rwanda. As organisations and individuals come together to celebrate Privacy Week 2025, let this be a moment of reflection and recommitment to the principles of data protection and privacy, values that reinforce trust in the digital age. The writer is a practicing commercial lawyer specialising in Data Protection and Privacy.
