East Africa / Rwanda
AvailableRwanda's privacy framework. Connected to your programme.
Law No 058/2021 relating to the protection of personal data and privacy
Turn local requirements into assigned work, linked records and evidence you can review.
Rwanda · in hlola
The framework at a glance.
Rwanda's data protection law, supervised by the National Cyber Security Authority.
- Country
- Rwanda
- Primary legislation
- Law No 058/2021 relating to the protection of personal data and privacy
- Regulator
- National Cyber Security Authority (Rwanda)
- Statutory clocks
- Breach notice 48 hours · rights requests 30 days
Key areas
From requirements to practical work.
- Governance2 controls to evidence
- Principles1 control to evidence
- Lawfulness1 control to evidence
- Special categories2 controls to evidence
- Transparency1 control to evidence
- Rights1 control to evidence
- Risk1 control to evidence
- Records1 control to evidence
- Security1 control to evidence
- Incidents1 control to evidence
- Transfers1 control to evidence
- Third parties1 control to evidence
See how the work connects.
Move from a requirement to the record, owner and evidence behind it.
Explore platform featuresStatuses support programme review; they are not legal certification.Illustrative records
What an inspector checks
14 controls, mapped to the Act.
RW-001 · Law No 058/2021: registration of data controllers and processors
Register with the supervisory authority before processing
Data controllers and processors must register with the NCSA and hold a valid registration certificate before processing personal data, and keep it current.
RW-002 · Law No 058/2021: personal data protection officer
Designate a personal data protection officer
Designate a data protection officer where the law requires it, with the knowledge and independence to advise the organisation and monitor compliance.
RW-003 · Law No 058/2021: principles relating to the processing of personal data
Apply the principles of processing
Process personal data lawfully, fairly and transparently, for specified purposes, limited to what is necessary, accurate, kept no longer than needed and secure.
Three are shown here; the full set, with tasks and evidence guidance, is in hlola.Pending review by counsel.
Bring Rwanda into your privacy programme.
See your readiness against Rwanda DPL in a demo set up for your organisation.