Rwanda

AI Playbook for Small States

Official source record dated 22 September 2024 for Rwanda concerning AI Playbook for Small States. See the linked imda.gov.sg source for the authoritative text, procedural context, and implementation details.

NCSA Minimum Cybersecurity Standards for Essential Service Providers

On 28 July 2024, the Minimum Cybersecurity Standards for Essential Service Providers (ESPs) entered into force. These standards define baseline cybersecurity requirements to ensure the confidentiality, integrity, and availability of critical infrastructure, ICT systems, and stakeholders’ data handled by ESPs in Rwanda. The regulation applies to ESPs operating within Rwanda and introduces a tiered approach, dividing requirements into three categories based on service criticality and user impac...

Data Protection and Privacy Office Guide on Designation of a Representative

On 2 July 2024, the Data Protection and Privacy Office (DPO) released the "Guide on Designation of a Representative," which outlines the requirements for Data Controllers and Data Processors based outside Rwanda to appoint a representative in Rwanda if they process personal data of individuals within the country. The representative must be a registered corporate body or legal entity in Rwanda, capable of understanding the designating party's operations, and handling data protection and privac...

DPO guide on contractual provisions for processing of personal data

On 9 April 2024, the Data Protection and Privacy Office (DPO) in Rwanda issued the "Guide on Contractual Provisions for Processing of Personal Data," outlining mandatory requirements for data processing agreements under Law N. 058/2021 of 13 October 2021 on personal data protection. The law mandates that Data Controllers and Data Processors formalise their processing activities through legally binding agreements, and the guide outlines provisions such as the scope of processing, data subject ...

DPO Standard Contractual Clauses for Personal Data Transfer Outside Rwanda under the Law No. 058/2021 of 13/10/2021

On 1 February 2024, the Data Protection and Privacy Office (DPO) issued the Standard Contractual Clauses (SCCs) for Personal Data Transfer Outside Rwanda under the Law Nº 058/2021 of 13/10/2021. These clauses ensure compliance with Article 49 of the law, applying to both the Discloser and the Recipient of the data. Provisions include implementing technical and organisational measures for data protection, purpose limitation, transparency, accuracy, data minimisation, storage limitation and sec...

Content moderation regulation in Ministerial Order No. 001/MINICT/2024 on the protection of children online

On 23 January 2024, Ministerial Order No. 001/MINICT/24 came into force. The order requires the implementation of content filtering tools and content labelling to limit minors' access to harmful content. The order defines harmful online content as any material that could negatively influence a child's development, such as child sexual abuse content, depictions of human sexual organs, or material exposing children to sexual acts or bestiality through images, videos, or audio. In particular, di...

Rwanda-Singapore Memorandum of Understanding on mutual socio-economic development

On 29 September 2023, Rwanda and Singapore signed a Memorandum of Understanding (MoU) on Mutual Socio-Economic Development. This five-year MoU aims to enhance cooperation in areas such as cybersecurity and information technology. The MoU follows a previous collaboration that supported Rwanda's institutional development and digitisation, enabling further technological advancements between the two countries.

DPO guidance on personal data inventory and readiness checklist tools

On 4 May 2023, the Data Protection and Privacy Office (DPO) issued guidance on personal data inventory and readiness checklist tools under Law N. 058/2021 of 13 October 2021. The guidance provides tools to support organisations in meeting legal requirements for personal data protection, including mapping personal data categories, establishing lawful processing bases, setting retention periods, and ensuring compliance with data protection standards. It outlines obligations related to data subj...

National Cyber Security Authority guidance right to portability, rectification and erasure

On 11 May 2022, the National Cyber Security Authority (NCSA) published guidance on the right to portability, rectification, and erasure. The guidance defines and clarifies three rights, the right to data portability, which enables individuals to transfer personal data between services, the right to rectification, which allows correction of inaccurate data and the right to erasure, which permits deletion of personal data under specific conditions. Data controllers must facilitate portability r...

Law No. 027/2022 establishing taxes on income expanding applicability to digital services

On 28 October 2022, Law No. 027/2022 establishing taxes on income, which includes provisions for the taxation of digital services, entered into force after being published in the official gazette. The law defines digital services to encompass online activities, including online advertising, the supply of user data, online search engines, social media platforms, digital content services, online gaming, cloud computing services, and standardised online teaching services. By incorporating these ...

National Cyber Security Authority guidance on right to object

On 10 August 2022, the National Cyber Security Authority (NCSA) published guidance on the right to object. The guidance outlines the provisions of Article 19 of Rwanda’s law No. 058/2021, which grants data subjects the right to object to the processing of their personal data. This right enables individuals to stop data controllers or processors from using their data under certain conditions, such as when the processing causes distress or is for direct marketing purposes. However, if the data ...

National Cyber Security Authority guidance on data protection terms and their meanings

On 8 April 2022, the National Cyber Security Authority (NCSA) published guidance on data protection terms and their meanings. This guidance outlines terminology related to personal data protection and privacy, necessary for understanding and complying with Rwanda’s laws. Terms include personal data, sensitive personal data, privacy, data controller, data processor, data processing, data subject, and third party. In particular, the guidance defines sensitive data as any information revealing a...

National Cyber Security Authority guidance on children's data processing

On 28 April 2022, the National Cyber Security Authority (NCSA) published guidance on children's data processing. The Data Protection and Privacy Law No. 058/2021 recognises that children may not fully understand the risks of sharing personal data and it includes additional safeguards. Article 9 specifies that processing a child's personal data under the age of 16 requires consent from a parent or guardian, and this consent must be in the child's best interest. However, consent is not needed i...

National Cyber Security Authority's Data Protection Office

On 31 March 2022, the National Cyber Security Authority (NCSA) established its data protection office (DPO). The DPO is tasked with overseeing the implementation of Law No. 058/2021 relating to the protection of personal data and privacy. The NCSA's DPO will manage the registration of data controllers and processors, investigate complaints, conduct data compliance audits, and promote awareness of data protection laws.

National Cyber Security Authority guide clarifying distinctions between data controller and data processor

On 17 March 2022, the National Cyber Security Authority (NCSA) published a guide clarifying distinctions between data controller and data processor under Rwanda's personal data protection law No. 058/2021. Data controllers decide how and why personal data is processed, while data processors handle data on behalf of controllers. Organisations can determine their role by assessing who makes decisions about data collection and processing. Entities can be both controllers and processors if they p...

National Cyber Security Authority's guide on personal data protection and privacy

On 20 January 2022, the National Cyber Security Authority (NCSA) published a guide on personal data protection and privacy. According to the guide, the law applies to entities within and outside Rwanda that process the personal data of individuals in Rwanda. It defines data processing, requires data controllers to register, and provides a compliance period until 15 October 2023. The law distinguishes between personal and sensitive personal data, emphasises privacy, and includes special provis...

National Cyber Security Authority guidance on right to access, object and restrict processing of personal data

On 10 January 2022, the National Cyber Security Authority (NCSA) published guidance on the right to access, object and restrict processing of personal data. The guidance states that Protection of Personal Data and Privacy Law No. 058/2021 empowers data subjects with significant rights, including the right to access personal data, the right to object to its processing, and the right to restrict processing. Right to access allows data subjects to request information about purposes of data proce...

National Cyber Security Authority guidance on consent, ownership and lawful data processing

On 14 December 2021, the National Cyber Security Authority (NCSA) published guidance on consent, ownership, and lawful data processing. The guidance outlines that Protection of Personal Data and Privacy Law No. 058/2021 establishes a framework for local and international firms to securely process personal data. The law specifies that user consent is a necessary requirement for the lawful collection and processing of personal data.

Data transfer regulation in Law No. 058/2021 relating to the protection of personal data and privacy

On 15 October 2021, Law No. 058/2021, relating to the protection of personal data and privacy, entered into force. Personal data may be transferred outside Rwanda if authorised by the supervisory authority with appropriate safeguards or if specific conditions are met, including consent from the data subject, contractual necessity, public interest, legal claims, vital interests, or legitimate interests. Transfers must comply with Rwanda's ratified international instruments. Contracts are requi...

Revenue Authority inquiry into taxing digital economy

On 7 August 2021, the Rwanda Revenue Authority concluded its inquiry into the challenges of implementing a digital service tax for companies operating in Rwanda. The inquiry focused on the potential financial strain this tax could impose on businesses that do not achieve profitability, within the context of Rwanda's ongoing efforts towards digitisation. The report also highlighted the need to balance revenue collection with fostering an environment conducive to innovation and investment, as d...

AI Readiness and Maturity Framework for Rwanda

AI Policy

RISA CEO Highlights Rwanda’s AI Policy and vision for Africa’s digital future at MWC Kigali 2025

National Artificial Intelligence Policy

AI law in Rwanda: Rwanda's National AI Policy, approved by Cabinet in April 2023, establishes the country as the first in Africa to adopt a comprehensive national AI policy. The policy aims to position Rwanda as a global center for AI research and innovation while promoting responsible and inclusive AI development....