Rwanda: Implemented Law No. 058/2021 relating to the protection of personal data and privacy including data protection regulation

On 15 October 2021, Law No. 058/2021, relating to the protection of personal data and privacy, entered into force. The law applies to data controllers, processors, and third parties involved in automated and manual data processing. It establishes requirements for the lawful, fair, and transparent processing of personal data, including obligations to uphold accuracy, accountability, and data minimisation principles. It further addresses the processing of sensitive personal data, mandating explicit consent or legitimate justification for such activities. Additionally, the law stipulates conditions for cross-border data transfers, requiring adherence to international standards and implementation of safeguards. The law grants individuals the right to access, correct, and object to the processing of their data while mandating organisations to implement security measures and report breaches.