Rwanda's data protection law: NCSA registration, 48-hour breaches and data storage

The law and the regulator

Law No 058/2021 of 13/10/2021 relating to the protection of personal data and privacy is Rwanda's data protection law. It gave organisations two years to comply, a period that ended in October 2023. The National Cyber Security Authority (NCSA) is the supervisory authority.

Registration

Data controllers and data processors must register with the NCSA before processing personal data, and receive a registration certificate. Apply through the NCSA's online system with a description of your processing, purposes, security measures and any transfers or storage outside Rwanda.

48-hour breach notification

The controller must notify the NCSA of a personal data breach within 48 hours of becoming aware of it, and inform the affected data subjects where the breach is likely to result in a high risk to them. Forty-eight hours leaves little room: decide in advance who assesses and who signs. See the Africa breach deadline comparison.

Storing data outside Rwanda

Rwanda's law requires personal data to be stored in Rwanda unless the controller or processor holds a valid certificate from the NCSA authorising storage outside the country. Cloud services hosted abroad therefore need authorisation before use, which makes the data map of where each system is hosted a compliance document, not just an IT one.

Fines

The NCSA can impose administrative fines of up to 1% of the organisation's global turnover in the previous financial year, in addition to criminal penalties for offences under the law.

Common questions