The legal framework for data privacy in Rwanda has changed since the introduction of the Data Protection Act, on October 15, 2021. While the initial years following the Data Protection Act’s enactment focused on awareness, the conclusion of the two-year grace period on October 15, 2023, marked the transition into an era of enforcement and accountability. ALSO READ: Strengthening Rwanda’s data protection culture: A call to action ahead of privacy week As Rwanda observes Data Privacy Week 2026, running from January 26 to 30, the message from the National Cyber Security Authority (NCSA), acting as the supervisory authority for personal data protection and privacy, is clear. Simply holding a registration certificate as a data controller or a data processor is the beginning, not the end, of a company’s or non-profit’s compliance journey. ALSO READ: Digital ID revolution: What citizens should expect Over the last four years, NCSA has moved beyond the awareness phase (2022–2024) and entered a period of deep capacity building. This is evidenced by the training of over 100 public sector Data Protection Officers (DPOs) and the facilitation of sector-specific workshops for pharmacists and local government entities. These initiatives indicate that NCSA now expects an advanced understanding of data protection principles from all companies and non-profits operating within Rwanda and beyond. Under NCSA’s 2026 theme, “Compliance is Beyond Registration,” accountability is now the primary obligation for every company and non-profit. In professional terms, accountability is the new obligation. Accountability means a company or non-profit must not only say they are taking action but must be able to prove it through documented policies, procedures, and evidence-based audits. Data controllers and processors must take ownership of the data they collect and ensure they protect the rights of individuals throughout the entire data life cycle. Global companies, including social media platforms, e-commerce marketplaces, Software as a Service (SaaS) providers, online video streaming services, music streaming platforms, and payment service providers, and others, must recognise that even if they are neither established nor resident in Rwanda, processing personal data of data subjects located in the country brings them within the scope of Rwanda’s Data Protection Act. Article 2(2)(b) of the Act provides that the Data Protection Act applies to any data controller or processor who is neither established nor resides in Rwanda but processes personal data of data subjects located in Rwanda. Where these companies process personal data of data subjects located in Rwanda, they are bound by the Rwandan Data Protection Act and must comply with its strict standards. To remain resilient, senior decision-makers within companies and non-profits must shift from paper compliance to Privacy by Design (PbD). This discipline requires data controllers and data processors to implement appropriate technical and organisational measures, such as pseudonymization and data minimization, both at the time of determining the means for processing and during the processing itself. A defining feature of the relationship between a data controller and a data processor is that the data processor can only act on the documented instructions of the data controller. Likewise, data controllers are limited to using data processors who provide sufficient guarantees regarding the implementation of appropriate security and organisational measures. Under Articles 48-50 of the Data Protection Act, the sharing, transfer, or storage of personal data outside Rwanda is restricted. Data controllers and data processors must obtain authorisation from NCSA for such sharing, transfer, or storage. While the Data Protection Act provides for significant penalties, including administrative fines of up to Rwf5 million or one percent (1%) of global annual turnover of the previous financial year, the primary risk is reputational. Large data breaches frequently make news headlines, leading to a permanent loss of consumer trust. In Rwanda’s advancing digital economy, the credibility and operability of a business depend on its capacity to protect the confidentiality, integrity, and availability of information. As the 2026 theme suggests, we must all learn to value our personal data. Although Rwanda’s Data Protection Act was inspired by global standards such as the EU’s General Data Protection Regulation (GDPR), it is not merely a copy. Instead, it introduces novel concepts such as digital succession, or data heirs, which grant data subjects the right to designate an heir to their data through a will. This distinctively positions data ownership as a right that extends beyond an individual’s lifetime, creating a new area of accountability. As Rwanda observes Data Privacy Week 2026, companies and non-profits are called upon to assess their current level of compliance with the Rwandan Data Protection Act and to move decisively beyond basic registration toward a culture of accountability. This begins with conducting comprehensive internal data protection audits to identify gaps, risks, and areas of non-compliance, followed by corrective actions informed by the audit findings. The author is a Corporate and Legal Services Lead at Andersen, a tax, legal, and business advisory firm in Rwanda.
