Rwanda

Article 2 of Law No 058/2021 applies the law both to controllers and processors established or residing in Rwanda and to those who are 'neither established nor resides in Rwanda, but processes personal data of data subjects located in Rwanda'. Note the wording is data subjects LOCATED in Rwanda, not Rwandan citizens. Article 29 makes registration mandatory for anyone who intends to be a controller or a processor, with no threshold; the National Cyber Security Authority's registration guide confirms this covers 'all public and private organizations, professionals such as doctors, lawyers, engineers, architects, notaries'. Article 39 requires foreign controllers and processors to designate a representative in writing, and the regulator's own guide adds that the representative must be a corporate body established in Rwanda and must itself hold a controller or processor registration. The representative duty is separate from, and additional to, the duty under Article 40 to designate a data protection officer.

Two different provisions are at work and they are easy to confuse. Article 50 governs STORAGE: 'The data controller or the data processor stores personal data in Rwanda. However, the storage of personal data outside Rwanda is only permitted if the data controller or the data processor holds a valid registration certificate authorising him or her to store personal data outside Rwanda, which is issued by the supervisory authority.' There is no consent exception and no necessity exception to Article 50. Article 48 governs SHARING AND TRANSFER to a third party outside Rwanda, and that one does have alternatives to regulator authorisation: the data subject's consent, or necessity for a contract, a public interest, a legal claim, someone's vital interests, a compelling legitimate interest, or an international instrument Rwanda has ratified. So a transfer can be lawful under Article 48 while the resulting offshore hosting is still unlawful under Article 50. SECTOR OVERRIDES: (1) TELECOMS — closed. RURA's telecom network security regulation requires that licensees ensure 'Subscriber's information are not transferred, stored or processed outside of the Republic of Rwanda', with no carve-out. (2) TAX AND ACCOUNTING RECORDS, all sectors — a copy must stay. The tax procedures law requires businesses to maintain books and documents for ten years in Rwanda. (3) HEALTH — no separate wall found; the regulator's July 2025 health sector guidance applies the general law and adds no localisation rule of its own. (4) FINANCE, INSURANCE, SECURITIES, GOVERNMENT CLOUD, EDUCATION, GAMBLING, MAPPING — no sector localisation rule found on an official Rwandan source, checked 19 August 2026, confidence medium. The regulator's own application form for offshore storage lists finance, telecommunication, health, education and aviation as the sectors it expects to see, which suggests it handles these through the general Article 50 permission rather than through separate sector bans.

There are two separate application routes and two separate forms, both live on the regulator's website today: 'Authorization to Store Outside Rwanda' and 'Authorization to Transfer Outside Rwanda'. The storage application asks for the name of each hosting provider, the destination country for primary storage and for disaster recovery separately, the type of hosting (shared, virtual private server, dedicated, cloud), any third parties involved, and a description of the data protection laws of each destination country. Supporting documents required are an application letter to the Chief Executive Officer of the National Cyber Security Authority, the hosting agreements, the storage architecture, and a data protection impact assessment for hosting abroad. The regulator has also published Standard Contractual Clauses for Personal Data Transfer Outside Rwanda (February 2024), drafted to satisfy Article 49's requirement of a written contract with the overseas recipient. The regulator's frequently asked questions explain that transfer authorisation is normally granted as part of registration, because the registration application already asks you to name the countries you will send data to, and that a later change means applying to amend your registration certificate. Note two things about the model. First, this is a case-by-case permission model, not a blocklist or an allowlist, so there is no list to check and no list that can be quietly populated. Second, the regulator holds a standing power to prohibit or suspend any transfer outside Rwanda in order to protect people's rights.

Law No 058/2021 designates the National Cyber Security Authority as the supervisory authority. The Data Protection and Privacy Office was launched on 31 March 2022. Observable evidence of activity in the last twelve months: a five-day ISO 31000 risk management course for data protection officers in July 2026; a study visit to Kenya's Office of the Data Protection Commissioner in July 2026; an awareness session with Bank of Kigali's insurance arm in June 2026; a week-long training for public and private sector data protection officers in June 2026; a Data Privacy Week campaign from 26 to 30 January 2026 themed 'Compliance is Beyond Registration'; a webinar drawing over 300 data protection officers; and a stakeholder consultation on draft implementing regulations in March 2026 attended by the Ministry of Justice, the National Bank of Rwanda, the utilities regulator and the food and drugs authority. Sector regulators enforce alongside it: the Rwanda Utilities Regulatory Authority audits telecom licensees at least once a year under its network security regulation, the National Bank of Rwanda supervises financial institutions, and the Rwanda Revenue Authority enforces the ten-year in-country books rule. We searched for published enforcement decisions and found none on the regulator's own site; the absence of a public decisions register is itself the finding.

The ceiling sits in Article 52: retain personal data until the purposes of the processing are fulfilled. The same article then lists the exceptions that let you keep it longer, and they are wide: retention authorised by law; retention required by a contract between the parties; where the data relates to the function or activity for which it was collected; and for preventing, detecting, investigating, prosecuting or punishing an offender. That structure means Rwanda resolves a floor-versus-ceiling conflict in favour of the floor — a longer statutory or contractual retention period overrides the delete-when-done principle rather than colliding with it. On the floors: the tax procedures law requires books and documents to be maintained for ten years in Rwanda, starting from 1 January following the fiscal year they relate to. The National Cyber Security Authority's Minimum Cybersecurity Standards, issued on 28 July 2023 in three versions for the financial sector, for essential service providers and for public institutions, require an event logging system with archiving procedures 'at least for a period of 12 months', and extend the same duty to outsourced service providers by contract. Separately, failure to carry out personal data logging is itself a listed administrative misconduct under Article 53, though the law sets no period for it.

Article 43 gives the controller 48 hours from awareness to communicate the breach to the supervisory authority, and gives a processor 48 hours from awareness to notify its controller. Article 44 then requires a report within 72 hours with all facts available, covering the nature of the breach, the approximate numbers of people and records involved, the contact details of the data protection officer, the measures taken to address and mitigate it, and — unusually — the controller's own proposal for how and when to tell affected individuals, for the regulator's approval. Article 45 covers communication to individuals where there is high risk. Missing any of these three steps is a separate listed administrative misconduct. Two more clocks sit on top for some organisations. Telecom licensees must 'immediately' share critical and major security incidents with the utilities regulator, and file a monthly report for moderate ones. Financial institutions, essential service providers and public institutions are told under the Minimum Cybersecurity Standards that Rwanda's national incident response team should be notified of every cyber incident; the standards set no fixed hour count for that, which is a gap worth building conservative internal deadlines around.

(1) Article 48 gives you seven routes to a lawful transfer, including the person's consent and contractual necessity. Article 50 gives you exactly one route to lawful offshore storage: a registration certificate that says so. Cloud hosting is storage. This is the single most common way to be compliant on paper and non-compliant in fact. (2) Article 9 sets the children's threshold at under sixteen, which is at the top of the international range and higher than the thirteen used by many global products. (3) Chapter VIII creates real offences, not administrative penalties: unlawful access, collection, use, sharing, transfer or disclosure of personal data carries one to three years' imprisonment and a fine of seven to ten million Rwandan francs (roughly five to eight thousand US dollars) for an individual; a company convicted of the same offences pays five percent of its previous year's annual turnover; and Article 63 lets the court order permanent or temporary closure of the entity or the premises. Separately, administrative misconducts under Article 53 — including operating without a registration certificate or letting one expire — attract a fine of two to five million Rwandan francs (roughly sixteen hundred to four thousand US dollars) or one percent of global turnover for a company. Note that word: GLOBAL turnover for the administrative sanction, annual turnover for the criminal one. (4) The representative and the data protection officer are separate obligations under Articles 39 and 40, and failing to designate a data protection officer is a listed misconduct. (5) The telecom network security regulation requires the licensee to have a Rwandan native as its chief technical officer or chief information officer, and to get the regulator's approval before outsourcing any service or operation to a third party. (6) A bonus trap: the registration application asks for your hosting invoice or agreement, so the regulator sees where your data actually sits at the moment you apply.

PENDING: draft implementing regulations under Law No 058/2021, consulted on 5 March 2026, focused on registration requirements and misconduct provisions. As of 19 August 2026 we found no published text and no adoption date, so this remains a draft with no legal effect. DORMANT SWITCHES, all already in the statute and all usable without consultation: (1) Article 48 final paragraph lets the supervisory authority prohibit or suspend any transfer of personal data outside Rwanda to protect people's rights — a single decision could strand an offshore architecture. (2) Article 53 lets the supervisory authority make a regulation creating additional administrative misconducts and sanctions beyond the nine listed in the law. (3) Article 51 requires the supervisory authority to put in place a regulation on migrating and managing personal data when a business changes hands or closes — that regulation does not appear to exist yet, and when it lands it will bite on every acquisition and wind-down. (4) A registration certificate can be cancelled before expiry on fifteen working days' written notice, which is a faster commercial risk than any fine. Also worth watching: Rwanda gazetted its first law regulating virtual asset business in mid-2026, which brings a new population of firms into scope of the registration and offshore storage regime; we could not verify the text on a Rwandan government domain and so make no claim about its data provisions.