Rwanda: Adopted DPO Standard Contractual Clauses for Personal Data Transfer Outside Rwanda under the Law N. 058/2021 of 13/10/2021

On 1 February 2024, the Data Protection and Privacy Office (DPO) issued the Standard Contractual Clauses (SCCs) for Personal Data Transfer Outside Rwanda under the Law Nº 058/2021 of 13/10/2021. These clauses ensure compliance with Article 49 of the law, applying to both the Discloser and the Recipient of the data. Provisions include implementing technical and organisational measures for data protection, purpose limitation, transparency, accuracy, data minimisation, storage limitation and security of processing. In case of a data breach, both parties must take immediate mitigation actions and notify the Supervisory Authority and data subjects as required. The Standard Contractual Clauses include annexes detailing the parties involved, the nature of the transferred data and the security measures implemented.