Rwanda: National Cyber Security Authority published guide clarifying distinctions between data controller and data processor

On 17 March 2022, the National Cyber Security Authority (NCSA) published a guide clarifying distinctions between data controller and data processor under Rwanda's personal data protection law No. 058/2021. Data controllers decide how and why personal data is processed, while data processors handle data on behalf of controllers. Organisations can determine their role by assessing who makes decisions about data collection and processing. Entities can be both controllers and processors if they perform both functions.