Skip to content
DPO360

Data protection in Rwanda.

Law No. 058/2021 on the protection of personal data and privacy was published and entered into force on 15 October 2021. The National Cyber Security Authority (NCSA) enforces it. It reaches organisations abroad that process the data of people in Rwanda, and sets a 48-hour breach deadline.

Get started Check your readiness
In force
October 2021
Regulator
NCSA
Breach deadline
48 hours

Supported via Kenya Hub

Kigali

At a glance

Rwanda, in seven lines.

Law
Law No. 058/2021 of 13 October 2021 on the protection of personal data and privacy
In force
15 October 2021; full compliance required from 15 October 2023
Regulator
National Cyber Security Authority (NCSA)
Registration
Mandatory for controllers and processors; certificate issued within 30 working days
Data protection officer
Required where core activities involve large-scale monitoring or sensitive data; may be a service provider
Breach notification
Within 48 hours to the NCSA (processors tell the controller within 48 hours)
Penalties
Administrative fine of RWF 2 to 5 million or 1% of global turnover; corporate criminal fine of 5% of annual turnover

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Key obligations

What the law asks of you.

Four obligations organisations in Rwanda meet first, and where we help with each.

Register with the NCSA

Controllers and processors register with the NCSA before processing. The compliance deadline for existing organisations was 15 October 2023.

DPO360 helps with

Registration and licensing filings with national data protection authorities

Designate a DPO where required

Required where core activities involve large-scale monitoring or sensitive data. The DPO can be a staff member or a service provider.

DPO360 helps with

Formal DPO appointment and mandate definition, where permitted by law

Report breaches within 48 hours

Controllers notify the NCSA within 48 hours of becoming aware. Processors notify the controller within 48 hours.

DPO360 helps with

Incident and breach logging, escalation and regulator notification

Keep data in Rwanda

Personal data is stored in Rwanda unless the NCSA authorises storage abroad.

DPO360 helps with

Data mapping across systems, vendors and cross-border flows

How the framework came together

From the law to the regulator.

  1. 13 to 15 October 2021

    The law is enacted

    Law No. 058/2021 is enacted on 13 October and published on 15 October 2021, Rwanda's first data protection legislation.

  2. October 2021 to 2023

    Two-year transition

    Organisations already operating have two years to conform their operations to the law.

  3. 15 October 2023

    Full compliance

    The transition ends, and registration with the NCSA becomes enforceable.

NCSA

Regulatory authority

National Cyber Security Authority (NCSA)

Rwanda's supervisory authority for personal data protection, alongside its cybersecurity mandate.

Visit the website

What the NCSA does

  • Registers controllers and processors

    Organisations register with the NCSA before they start processing.

  • Receives breach notifications

    Breaches are notified to the NCSA within 48 hours.

  • Supervises and enforces

    Supervises compliance and enforces the law with administrative and criminal sanctions.

Penalties

What non-compliance can cost.

Administrative fines

1%

of global turnover, administrative fine

Misconduct such as operating without a registration certificate carries an administrative fine of RWF 2 to 5 million, or 1% of global turnover of the preceding financial year (1% for corporate bodies).

Criminal offences

5%

of annual turnover, corporate criminal fine

Offences in Articles 56 to 61, including selling personal data contrary to the law, carry imprisonment for individuals and a fine of 5% of annual turnover for corporate bodies.

Readiness check

Where do you stand?

Tick what is already in place. A quick read on where you stand in Rwanda, for orientation only.

0/6

Plenty to tighten.

A short scoping call will map the gaps and the order to close them.

Close the gaps with us

Compare

Eight countries at a glance.

Tap a country to highlight its column. Scroll sideways for the rest.

LawProtection of Personal Information Act (POPIA)Data Protection Act, 2019Nigeria Data Protection Act (NDPA), 2023Data Protection and Privacy Act, 2019Personal Data Protection Act, 2022Law No. 058/2021Data Protection Act, 2021Data Protection Act, 2024
In forceJuly 2021 (most provisions from July 2020)November 2019June 2023May 2019 (regulations March 2021)May 2023October 2021 (full compliance October 2023)April 2021June 2024
RegulatorInformation RegulatorOffice of the Data Protection Commissioner (ODPC)Nigeria Data Protection Commission (NDPC)Personal Data Protection Office (PDPO)Personal Data Protection Commission (PDPC)National Cyber Security Authority (NCSA)Office of the Data Protection CommissionerMalawi Communications Regulatory Authority (MACRA)
RegistrationRegister your Information Officer with the RegulatorMandatory above thresholds, and in certain sectors, with the ODPCControllers and processors of major importance register with the NDPCEvery data collector, processor and controller registers with the PDPOCollectors and processors register with the PDPCControllers and processors register with the NCSANo one may act as a controller or processor without registeringControllers and processors of significant importance register with MACRA
Data protection officerInformation Officer required for every organisationMay be designated; relevant for public bodies, large-scale monitoring and sensitive dataMandatory for controllers of major importanceA DPO must be designated by the head of the institutionA DPO must be appointedRequired in certain cases (large-scale monitoring or sensitive data)A DPO must be appointed, under the Commissioner's guidelinesRequired for public authorities, and for large-scale monitoring or sensitive data
Breach notificationAs soon as reasonably possible, to the Regulator and data subjectsWithin 72 hours to the ODPC; data subjects within a reasonably practical periodWithin 72 hours to the NDPC; data subjects immediately where high riskImmediately, to the PDPOPromptly, to the PDPCWithin 48 hours to the NCSAWithin 24 hours to the Commissioner; data subjects as soon as practicableWithin 72 hours to MACRA
PenaltiesAdministrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offencesUp to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 yearsMajor importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2%Up to about UGX 4.8 million and/or 10 years for listed offencesPenalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 yearsAdministrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnoverCorporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 yearsAdministrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years
Open briefing →Open briefing →Open briefing →Open briefing →Open briefing →Open briefing →Open briefing →

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Reviewed October 2026 against: Law No. 058/2021 of 13 October 2021 (Articles 29, 30, 53 and 56 to 61) and NCSA registration guidance.

Additional resources

Read the source documents.

National Cyber Security AuthorityRegulator websiteLaw No. 058/2021Legislation

Supported through

Kenya Hub

East, Central & Southern Africa

DPO360 in Rwanda

How we support organisations in Rwanda.

Rwanda is supported through our Kenya hub, which covers East, Central & Southern Africa, with delivery coordinated from our Nairobi headquarters.

  • Registration and licensing filings with the national authority
  • Breach logging, escalation and regulator notification
  • Consent, policy and records-of-processing frameworks
  • Data mapping, including where data is processed
  • Data subject access request management
  • A standing DPO appointment, with DPO-as-a-Service

2nd Floor 90 JGO, James Gichuru Road, Lavington

P.O Box 40583-00100 Nairobi, Kenya

+254735360360 | +447394407463

Ready to Make Privacy Your Advantage?

Speak to our team about compliance in Rwanda and beyond.

Book a consultationDPO-as-a-Service