Rwanda

Article 2 of Law No 058/2021 covers two groups. First, anyone based or living in Rwanda who decides how personal data is used, plus the suppliers who handle that data for them. Second, anyone who is neither based nor living in Rwanda but who uses or stores personal data about people located in Rwanda. Note the words: located in Rwanda. That means anyone in the country, not only Rwandan citizens. Article 29 makes registration compulsory for anyone who plans to handle personal data, with no minimum size. The National Cyber Security Authority's registration guide confirms this covers 'all public and private organizations, professionals such as doctors, lawyers, engineers, architects, notaries'. Article 39 says companies from outside Rwanda must appoint a representative in writing. The regulator's own guide adds that the representative must be a company set up in Rwanda. It must also be registered with the regulator in its own right. That is a separate duty from Article 40, which says you must appoint a data protection officer. You need both.

Two rules are at work here, and people mix them up. Article 50 is about storage. It says you store personal data in Rwanda. You may store it outside Rwanda only if you hold a valid registration certificate from the supervisory authority that allows this. There is no consent exception and no necessity exception to Article 50. Article 48 is about sharing or sending data to someone else outside Rwanda. That rule does have alternatives to regulator permission. You can rely on the consent of the person the data is about. Or you can show the transfer is needed for a contract, for the public interest, for a legal claim, or for someone's vital interests. A compelling legitimate interest also counts, and so does an international agreement Rwanda has ratified. So a transfer can be legal under Article 48 while the hosting that follows is still illegal under Article 50. Some industries have extra rules. Telephone and internet companies are shut out completely. The utilities regulator's telecom network security rules say licence holders must ensure subscriber information is not transferred, stored or used outside the Republic of Rwanda. There is no exception. Tax and accounting records are a separate point, and this one applies to every industry. A copy must stay in the country. The tax procedures law says businesses must keep their books and documents for ten years in Rwanda. Health has no extra rule. The regulator's health guidance from July 2025 applies the general law and adds nothing about where data must sit. We found no rule about where data must sit for finance, insurance, securities, government cloud, education, gambling or mapping. We checked on 19 August 2026 and our confidence is medium. The regulator's application form for storing data abroad names finance, telecommunication, health, education and aviation as the industries it expects to see. That suggests it handles them through the general Article 50 permission, not through separate bans.

There are two application routes and two forms. Both are live on the regulator's website today. One is 'Authorization to Store Outside Rwanda'. The other is 'Authorization to Transfer Outside Rwanda'. The storage form asks for the name of each hosting provider. It asks for the destination country for your main storage and for your disaster recovery copy, separately. It asks what type of hosting you use: shared, virtual private server, dedicated or cloud. It asks about any other companies involved. It also asks you to describe the data protection laws of each destination country. You must attach four things. A letter addressed to the Chief Executive Officer of the National Cyber Security Authority. Your hosting agreements. A description of your storage setup. And a written risk assessment covering hosting personal data abroad. The regulator has also published Standard Contractual Clauses for Personal Data Transfer Outside Rwanda, dated February 2024. They exist to meet Article 49, which requires a written contract with the company receiving the data overseas. The regulator's frequently asked questions explain that permission to transfer is normally granted as part of registration. That is because the registration form already asks which countries you will send data to. If that changes later, you apply to amend your registration certificate. Two things to understand about how this works. First, the regulator decides case by case. There is no approved list of countries and no banned list. So there is no list to check, and none that can be quietly filled in later. Second, the regulator holds a standing power to stop or pause any transfer out of Rwanda to protect people's rights.

Law No 058/2021 names the National Cyber Security Authority as the supervisory authority. Its Data Protection and Privacy Office opened on 31 March 2022. Here is what we can see it doing in the last twelve months. It ran a five-day ISO 31000 risk management course for data protection officers in July 2026. It made a study visit to Kenya's Office of the Data Protection Commissioner in July 2026. It ran an awareness session with Bank of Kigali's insurance arm in June 2026. It ran a week-long training for data protection officers from public and private bodies in June 2026. It ran a Data Privacy Week campaign from 26 to 30 January 2026, themed 'Compliance is Beyond Registration'. It ran a webinar that drew over 300 data protection officers. In March 2026 it consulted on draft rules. The Ministry of Justice, the National Bank of Rwanda, the utilities regulator and the food and drugs authority all took part. Other regulators enforce alongside it. The Rwanda Utilities Regulatory Authority audits telecom licence holders at least once a year under its network security rules. The National Bank of Rwanda supervises financial institutions. The Rwanda Revenue Authority enforces the ten-year rule on keeping books in the country. We searched for published enforcement decisions and found none on the regulator's own site. There is no public register of decisions at all. That absence is itself the finding.

Article 52 sets the general rule. Keep personal data until the purposes you collected it for are met, then stop. The same article then lists exceptions, and they are wide. You may keep data longer where a law allows it. You may keep it longer where a contract between the parties requires it. You may keep it where the data relates to the function or activity you collected it for. And you may keep it to prevent, detect, investigate, prosecute or punish an offender. The effect is that a longer legal or contractual period wins. It overrides the delete-when-done rule rather than clashing with it. Now the minimum periods. The tax procedures law says books and documents must be kept for ten years in Rwanda. The ten years start on 1 January following the tax year the records relate to. The National Cyber Security Authority issued its Minimum Cybersecurity Standards on 28 July 2023. There are three versions: one for the financial sector, one for essential service providers and one for public institutions. All three require an event logging system with archiving procedures 'at least for a period of 12 months'. You must put the same duty into your contracts with outsourced service providers. Separately, failing to log personal data activity is listed as administrative misconduct under Article 53. The law sets no period for that one.

Article 43 gives you 48 hours from the moment you learn of a breach to tell the supervisory authority. A supplier who handles data for you gets the same 48 hours to tell you. Article 44 then requires a report within 72 hours with all the facts available. The report must cover what happened, roughly how many people and records are affected, and the contact details of your data protection officer. It must cover what you have done to fix the problem and limit the damage. Unusually, you must also propose how and when you will tell the people affected, and the regulator approves that plan. Article 45 covers telling people directly where the risk to them is high. Missing any of these three steps is separately listed as administrative misconduct. Some organisations have two more deadlines on top. Telecom licence holders must share critical and major security incidents with the utilities regulator immediately, and report moderate ones monthly. Financial institutions, essential service providers and public institutions are told under the Minimum Cybersecurity Standards to notify Rwanda's national incident response team of every cyber incident. The standards set no fixed number of hours. That is a gap, so set your own tight internal deadline.

(1) Article 48 gives you seven routes to a lawful transfer, including the person's consent and the needs of a contract. Article 50 gives you exactly one route to lawful storage abroad: a registration certificate that says you can. Cloud hosting counts as storage. This is the most common way to look compliant on paper while breaking the law in fact. (2) Article 9 sets the age for children at under sixteen. That is at the top of the international range. Many global products use thirteen. (3) Chapter VIII creates real crimes, not administrative penalties. Unlawful access, collection, use, sharing, transfer or disclosure of personal data carries one to three years in prison for an individual. It also carries a fine of seven to ten million Rwandan francs, roughly five to eight thousand US dollars. A company convicted of the same crimes pays five percent of its previous year's annual turnover. Article 63 lets a court close the business or its premises, permanently or temporarily. Administrative misconduct under Article 53 works differently. It includes running without a registration certificate, or letting yours expire. The fine is two to five million Rwandan francs, roughly sixteen hundred to four thousand US dollars. For a company it can be one percent of global turnover instead. Note that difference. The administrative fine uses global turnover. The criminal fine uses annual turnover. (4) The representative and the data protection officer are two separate duties, under Articles 39 and 40. Failing to appoint a data protection officer is listed misconduct. (5) The telecom network security rules require the licence holder to have a Rwandan native as chief technical officer or chief information officer. They also require the regulator's approval before you outsource any service or operation to another company. (6) One more trap. The registration form asks for your hosting invoice or agreement. So the regulator sees where your data actually sits at the moment you apply.

Pending: draft rules under Law No 058/2021. The regulator consulted on them on 5 March 2026. They focus on registration requirements and misconduct rules. As of 19 August 2026 we found no published text and no start date. So this is still a draft with no legal effect. The regulator also holds four powers that are already in the law. It can use any of them without consulting anyone. One. The last paragraph of Article 48 lets the supervisory authority stop or pause any transfer of personal data out of Rwanda to protect people's rights. A single decision could strand a setup built on overseas hosting. Two. Article 53 lets the supervisory authority write a rule adding new kinds of administrative misconduct and new penalties, beyond the nine already in the law. Three. Article 51 requires the supervisory authority to write rules on moving and managing personal data when a business changes hands or closes. Those rules do not appear to exist yet. When they arrive they will apply to every acquisition and every wind-down. Four. A registration certificate can be cancelled before it expires, on fifteen working days' written notice. That is a faster commercial risk than any fine. One more thing to watch. Rwanda published its first law regulating virtual asset business in mid-2026. That brings a new group of firms under the registration and overseas storage rules. We could not verify the text on a Rwandan government website, so we make no claim about what it says on data.