Data protection compliance in Rwanda
Rwanda has one of the region's strictest data protection regimes, including rules on where data can be stored. We help you register with the NCSA and comply.
Key facts
- Main law
- Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy
- Regulator
- National Cyber Security Authority (NCSA)
- Registration
- Data controllers and processors must register with the NCSA before processing personal data.
- Data storage
- Storing personal data outside Rwanda requires authorisation from the NCSA.
- Breach notification
- Notify the NCSA within 48 hours of becoming aware of a breach.
General information, last reviewed October 2026. Laws and regulator practice change, so confirm specifics with our team. This is not legal advice.
What you need to do
- Register with the NCSA before you start processing personal data
- Get authorisation before storing personal data outside Rwanda
- Have a lawful basis, such as consent, for processing
- Respect data subject rights, including access, correction and erasure
- Run impact assessments for high-risk processing
- Appoint a Data Protection Officer where required
Compliance in Rwanda, handled
Registration
We prepare and submit your registration with the regulator.
Gap assessment
We review your product and operations against the law and give you a clear fix list.
Implementation
We fix the gaps in your policies, processes and code, including consent, audit logs and access control.
Outsourced DPO
We act as your Data Protection Officer on a monthly retainer.
Operating in more than one country? See our guides for Kenya, Uganda, Tanzania, or read our East Africa expansion checklist.
Ready to talk?
Book a free 30-minute consultation. Tell us what you're building and we'll tell you what to fix first.