Rwanda

RW · RWA · Middle East & Africa

3 regulators · 10 laws & regulations · 7 obligations

Obligation	Timing	Regulator	Arises from	Source
All industries
Lawful processing, consent and data subject rights	Ongoing; 30 days for objection and portability requests	NCSA	Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy	source
Consent must be freely given and can be withdrawn as easily as it was given (Arts. 6, 8). Data subjects have rights of access (Art. 18), objection (Art. 19), portability (Art. 20) and not to be subject to solely automated decisions (Art. 21); the law also covers restriction, erasure and rectification (Arts. 22-26). Responses to objection and portability requests are due within 30 days.
Personal data breach notification	Deadline Within 48 hours to the NCSA; report within 72 hours	NCSA	Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy	source
Art. 43: the controller notifies the supervisory authority within 48 hours of becoming aware of the incident, and a processor notifies the controller within the same period. Art. 44: a breach report follows within 72 hours. Art. 45: affected individuals are told where the breach is likely to create a high risk, with no fixed hours stated.
Report systems used for cybercrime and cyber threat incidents	Deadline On becoming aware	NCSA	—	source
Art. 5: a service provider that learns its systems are being used for an offence must report it to the cyber security authority and preserve relevant communication data. Art. 47 makes knowing failure to report cyber threat incidents an offence.
No obligations match these filters.