Rwanda

Art. 3 requires public organs, private institutions, civil society and international organisations to put mechanisms in place to prevent corruption, ensure no corruption occurs within them and submit reports to the relevant authorities. The Ombudsman may request administrative sanctions against the leader of a non-compliant organ.

Consent must be freely given and can be withdrawn as easily as it was given (Arts. 6, 8). Data subjects have rights of access (Art. 18), objection (Art. 19), portability (Art. 20) and not to be subject to solely automated decisions (Art. 21); the law also covers restriction, erasure and rectification (Arts. 22-26). Responses to objection and portability requests are due within 30 days.

Art. 43: the controller notifies the supervisory authority within 48 hours of becoming aware of the incident, and a processor notifies the controller within the same period. Art. 44: a breach report follows within 72 hours. Art. 45: affected individuals are told where the breach is likely to create a high risk, with no fixed hours stated.

Art. 5: a service provider that learns its systems are being used for an offence must report it to the cyber security authority and preserve relevant communication data. Art. 47 makes knowing failure to report cyber threat incidents an offence.

Art. 10 requires the board to set AML/CFT policies and procedures and review them at least once every three years; Art. 13(c) requires a money laundering compliance function led by the money laundering reporting officer, with an independent audit function (13(d)).

Art. 12(1) requires records of the risk assessment to be kept for a minimum of 10 years from their official date of creation or issuance.

Art. 10(1) requires a legal entity wishing to provide virtual asset services to apply to the CMA for a licence; Art. 10(2) sets conditions including local presence and AML/CFT controls. Art. 15(1) bars natural persons from the business and Art. 34 provides sanctions for unlicensed services.