Rwanda: Implemented Law No. 058/2021 relating to the protection of personal data and privacy, including data transfer regulation

On 15 October 2021, Law No. 058/2021, relating to the protection of personal data and privacy, entered into force. Personal data may be transferred outside Rwanda if authorised by the supervisory authority with appropriate safeguards or if specific conditions are met, including consent from the data subject, contractual necessity, public interest, legal claims, vital interests, or legitimate interests. Transfers must comply with Rwanda's ratified international instruments. Contracts are required for such transfers, specifying responsibilities to ensure legal compliance. The supervisory authority can regulate contract forms, ensure compliance, and suspend transfers to protect data subjects' rights.