Rwanda: Signed Law No. 058/2021 relating to the protection of personal data and privacy, including data transfer regulation

On 13 October 2021, Law No. 058/2021, relating to the protection of personal data and privacy, was signed. Personal data may be transferred outside Rwanda if authorised by the supervisory authority with appropriate safeguards or if specific conditions are met, including consent from the data subject, contractual necessity, public interest, legal claims, vital interests, or legitimate interests. Transfers must comply with Rwanda's ratified international instruments. Contracts are required for such transfers, specifying responsibilities to ensure legal compliance. The supervisory authority can regulate contract forms, ensure compliance, and suspend transfers to protect data subjects' rights.