Data protection
The Law applies to processing 'by electronic or other means', to a controller or processor established or resident in Rwanda that processes data while in Rwanda, and to one established elsewhere that processes the data of data subjects located in Rwanda (art. 2). Its supervisory authority is 'a public authority in charge of cyber security' (art. 3(23)), that is the National Cyber Security Authority, whose Data Protection and Privacy Office runs dpo.gov.rw. 'Sensitive personal data' covers race, health status, criminal records, medical records, social origin, religious or philosophical beliefs, political opinion, genetic or biometric information, sexual life and family details (art. 3(2)); consent must be freely given, specific, informed and unambiguous and may be oral, written or electronic (arts 3(18) and 6), and can be withdrawn at any time as easily as it was given (art. 8). Article 23 of the Constitution separately protects the privacy of a person, family, home and correspondence.
Data subjects have defined rights, each exercised in writing or electronically. They can obtain the purposes of processing, a copy of their data, a description of what is held, the source and any transfer abroad (art. 18); object to processing that causes or is likely to cause loss, sadness or anxiety, and to direct marketing (art. 19); have their data sent to them or to another controller (art. 20); refuse decisions based solely on automated processing, including profiling (art. 21); restrict processing (art. 22); request erasure when the data are no longer necessary, consent is withdrawn, objection succeeds or the processing was unlawful (art. 23); and rectification (art. 24). For objection, portability, erasure and rectification the controller must answer within 30 days; a person unsatisfied with a response may appeal to the supervisory authority within 30 days of receiving it, and the authority replies within 60 days of receiving the appeal.
Duties run in the other direction. Anyone who intends to act as a controller or processor must register with the authority (art. 29), which issues the certificate within 30 working days of the application (art. 31). A controller must tell the authority of a personal data breach within 48 hours, file a report within 72 hours (arts 43 and 44) and, where the risk is high, tell the data subjects (art. 45). Personal data are stored in Rwanda, and storage abroad is allowed only with a registration certificate authorising it (art. 50); transfers abroad need the authority's authorisation or another ground listed in art. 48. A child's data may be processed only with the consent of the holder of parental responsibility when the child is under 16, unless processing is needed to protect the child's vital interest (art. 9). Controllers already operating had a transitional period of at most two years from the publication of 15/10/2021 (art. 67).
Sanctions come in two layers. The authority can impose an administrative fine of FRW 2,000,000 to 5,000,000, or one per cent of global turnover of the previous financial year, for misconducts such as operating without a certificate, failing to keep processing records, failing to appoint a data protection officer or failing to report a breach (art. 53); the decision can be challenged in the competent court (art. 54). Criminal penalties are higher: accessing, collecting, using, sharing or disclosing personal data contrary to the Law, one to three years and FRW 7,000,000 to 10,000,000 (art. 56); unlawful destruction, erasure, concealment or alteration, three to five years and the same fine (art. 58); selling personal data unlawfully, five to seven years and FRW 12,000,000 to 15,000,000 (art. 59); and unlawful processing of sensitive data, seven to ten years and FRW 20,000,000 to 25,000,000 (art. 60). A corporate body that commits these offences pays five per cent of its previous annual turnover (art. 62), and a person who suffers serious damage may claim compensation in court (art. 65).
The Penal Code and the cybercrime law protect privacy as well. Secretly listening to or recording a person, taking photos or recordings, or disclosing them without authorisation, in bad faith, carries six months to one year and a fine of FRW 1,000,000 to 2,000,000 (art. 156), and publishing an edited version of a person's statements, images or photos without saying that it is not the original carries the same penalty (art. 157). Article 35 of Law N° 60/2018 punishes cyber-stalking, including taking pictures or recordings of a person in bad faith without consent, with six months to two years and FRW 1,000,000 to 2,000,000, on the complaint of the person concerned.
Key points
| Statute | Law N° 058/2021 of 13/10/2021, Official Gazette Special of 15/10/2021 |
|---|---|
| Reach | Processing in Rwanda, and controllers abroad processing data of people located in Rwanda (art. 2) |
| Supervisory authority | Public authority in charge of cyber security: the National Cyber Security Authority (art. 3(23)) |
| Child's data | Consent of the holder of parental responsibility when the child is under 16 (art. 9) |
| Controller's answer to a request | Within 30 days for objection, portability, erasure and rectification; appeal to the authority within 30 days; authority replies within 60 days (arts 18 to 20, 23 and 24) |
| Breach of personal data | Authority told within 48 hours; report within 72 hours (arts 43 and 44) |
| Administrative fine | FRW 2 million to 5 million, or 1% of global turnover of the previous financial year (art. 53) |
| Unlawful sale of personal data | 5 to 7 years and FRW 12 million to 15 million (art. 59) |
| Unlawful processing of sensitive data | 7 to 10 years and FRW 20 million to 25 million (art. 60) |
In practice
- Write to the controller, in writing or electronically, to ask for access, objection, erasure or rectification; for the last three the Law gives the controller 30 days to answer.
- If the answer is refused or unsatisfactory, appeal to the supervisory authority within 30 days: the data protection office takes complaints at complaint@dpo.gov.rw and through the 'File a Complaint' service and 'Complaint Lodging Guide' on dpo.gov.rw, and its toll-free number is 9080.
- Claim compensation in the competent court after serious damage caused by a breach of the Law; the controller or processor is exempt only if it proves it was not responsible (art. 65).
- Report a suspected data breach by email to databreach@dpo.gov.rw; controllers are themselves bound to notify within 48 hours.
- For secret recordings or edited images, file a complaint with the Rwanda Investigation Bureau under arts 156 and 157 of the Penal Code (hotline 166).
Where to go
- Data Protection and Privacy Office, 21 KG 7 Ave, Kacyiru, A&P Building, Ground Floor, Kigali; telephone +250 782 847 756; toll-free 9080; dpp@dpo.gov.rw, complaint@dpo.gov.rw, registration@dpo.gov.rw, databreach@dpo.gov.rw.
- National Cyber Security Authority, 8 KG 7 St, Kacyiru, Telecom House, 5th floor, Kigali; info@ncsa.gov.rw (address and email as listed on cyber.gov.rw).
- Rwanda Investigation Bureau, hotline 166, for the criminal offences in the Law and in the Penal Code.
Worth knowing
The right to erasure in art. 23 does not apply to the extent that processing is necessary for reasons of public interest, research or statistics, a legal obligation, or the establishment, exercise or defence of legal claims; and the Law says that personal data 'are not subject to succession' (art. 25), although a will may give an heir full or restricted rights over data still in use.
Frequently asked questions
At what age can a child consent to the use of personal data in Rwanda?
Under art. 9 of Law N° 058/2021 a controller that knows the data belong to a child under 16 must obtain the consent of the holder of parental responsibility, given in the child's interest, except where processing is necessary to protect the child's vital interest.
Can I make a company delete my personal data?
Yes, in writing or electronically, on the grounds in art. 23 (no longer necessary, consent withdrawn, successful objection, unlawful processing); the controller must answer in 30 days and you may appeal to the supervisory authority within 30 days of the answer.
What is the penalty for selling someone's personal data?
Art. 59 sets five to seven years and a fine of FRW 12 million to 15 million, or one of the two; a corporate body pays five per cent of its previous annual turnover under art. 62.
Sources
- Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, Official Gazette Special of 15/10/2021 -- gazette copy archived by Gazettes.Africa — arts 2, 3, 6, 8, 9, 18 to 25, 29, 31, 43 to 45, 48, 50, 53, 54, 56, 58 to 60, 62, 65 and 67 (English column of the gazette)
- Data Protection and Privacy Office (dpo.gov.rw) -- complaint and registration services, contacts — complaint and registration services, emails, toll-free 9080, address
- National Cyber Security Authority (NCSA) -- official website: contact details — address and contact of the National Cyber Security Authority
- Law N° 68/2018 of 30/08/2018 determining offences and penalties in general (Penal Code), Official Gazette Special of 27/09/2018 -- gazette copy published by Laws.Africa — arts 156 and 157
- Law N° 60/2018 of 22/08/2018 on prevention and punishment of cyber crimes, Official Gazette Special of 25/09/2018 -- gazette copy published by Laws.Africa — art. 35 (cyber-stalking, prosecution only on complaint)
- Constitution of the Republic of Rwanda of 4 June 2003 with amendments through 2015 (Constitute Project text) — art. 23: privacy of a person, family, home and correspondence
- Rwanda Investigation Bureau (RIB) -- contact page: hotlines, headquarters, opening hours — hotline 166
The general article: Data protection · Compare with another country
Romance scams
Article 174 of Law N° 68/2018 covers the classic scam: a person who, by deception, obtains another person's property or part of his or her finances by using false names or qualifications, by making positive promises or by threatening future misfortunes, commits fraud and faces two to three years and a fine of FRW 3,000,000 to 5,000,000. When the fraud is committed by a person who intends to issue shares, bills, securities, bonds, vouchers or any other cash value for a business, trading or industrial company, the penalty is three to five years and a fine of more than FRW 5,000,000 and up to FRW 7,000,000. Law N° 60/2018 of 22/08/2018 adds offences committed through computers: phishing (art. 36) and impersonation (art. 40).
Article 36 of the cybercrime law targets anyone who establishes and uses an electronic message or a website in order to get confidential information from the visitor or the recipient, intending to use it unlawfully, especially to steal money or to gain access to a computer system; the penalty is one to two years and FRW 1,000,000 to 3,000,000. Article 40 punishes a person who intentionally uses somebody's identity over the internet in bad faith, to profit, to mislead or to destroy reputation, when the identity is similar or confusingly similar to the name or description of another person or body, with three to five years and FRW 1,000,000 to 3,000,000; this is the provision that fits a fake profile built to win someone's trust. Article 21 punishes disclosing an access code or other means of access to a program or data, when the aim is a wrongful gain, with one to two years and FRW 1,000,000 to 3,000,000.
Pressure for money is punished separately. Blackmail, which art. 129 defines as demanding a signature, a disclosure, money or any other asset by threatening to denounce or to reveal or attribute information, true or false, that may damage the honour or reputation of the victim or of another person, carries one to three years and FRW 100,000 to 300,000, and more than three years and up to five, with FRW 1,000,000 to 2,000,000, if the threat is carried out. Extortion by violence or coercion, demanding a signature, a fingerprint or a discreditable gain or payment, carries three to five years and FRW 3,000,000 to 5,000,000 (art. 171), and threats with intent to harm one to two years and FRW 300,000 to 500,000 (art. 128). Publishing rumours knowingly through a computer that may incite fear or make a person lose credibility carries three to five years and FRW 1,000,000 to 3,000,000 (Law N° 60/2018 art. 39), and a false indecent message or one directed against a child the same range under art. 38.
Courts may in all cases order the confiscation of a computer, software or media used to commit an offence under the cybercrime law and the proceeds gained, and may order the permanent or temporary closure of the premises or body where it was committed, if it happened with the knowledge of the owner or management (art. 52). A criminal complaint can start at a police station or at the Rwanda Investigation Bureau, whose home page carries a 'Report a case' button for its online portal and features an awareness video on phone-based fraud, and whose line 166 takes emergency calls and 'crime related information'.
Key points
| Fraud by false names, qualifications or promises | 2 to 3 years and FRW 3 million to 5 million (Penal Code art. 174) |
|---|---|
| Fraud for issuing shares, bonds or securities of a company | 3 to 5 years and FRW 5 million to 7 million (art. 174, second paragraph) |
| Phishing | 1 to 2 years and FRW 1 million to 3 million (Law N° 60/2018 art. 36) |
| Impersonation on the internet | 3 to 5 years and FRW 1 million to 3 million (art. 40) |
| Blackmail | 1 to 3 years and FRW 100,000 to 300,000; over 3 up to 5 years and FRW 1 million to 2 million if carried out (Penal Code art. 129) |
| Extortion by violence or coercion | 3 to 5 years and FRW 3 million to 5 million (art. 171) |
| Cyber-stalking | 6 months to 2 years and FRW 1 million to 2 million; prosecuted only on the complaint of the person concerned (Law N° 60/2018 art. 35) |
| Confiscation and closure | Computer, software or media used and proceeds may be confiscated; premises may be closed (art. 52) |
| Report a crime | Rwanda Investigation Bureau line 166 or online 'Report a case' |
In practice
- Keep every message, number, account name and payment confirmation before blocking the sender: art. 174 turns on false names or qualifications and promises, so the messages are the proof.
- Report at a police station or to the Rwanda Investigation Bureau: call 166, or use the 'Report a case' portal linked from rib.gov.rw.
- If the person threatens to reveal information about you unless you pay or sign something, report it as blackmail (art. 129): the offence is defined by the demand made under that threat, and the heavier penalty applies once the threat is carried out.
- If your personal data were obtained or used illegally, also complain to the data protection office (complaint@dpo.gov.rw): arts 56 and 59 of Law N° 058/2021 punish unlawful access, sharing and sale of personal data.
- File your own complaint for online harassment, because art. 35 of Law N° 60/2018 allows prosecution only on the complaint of the person offended.
Where to go
- Rwanda Investigation Bureau, KN5 Rd, Kamukina, Kigali: hotline 166, online 'Report a case' portal, open Monday to Friday 8:00 to 17:00 with emergency hotlines 24/7 at weekends and on holidays.
- National Cyber Security Authority, 8 KG 7 St, Kacyiru, Telecom House, 5th floor, Kigali, which has a 'Report Incident' page for cyber security incidents.
- Data Protection and Privacy Office, complaint@dpo.gov.rw, toll-free 9080, where the scam involved misuse of personal data.
Worth knowing
Art. 174 of the Penal Code was not among the articles rewritten by Law N° 69/2019 or Law N° 059/2023, so the 2018 penalties quoted here are the ones in the three gazettes opened; prosecution for cyber-stalking and spamming under Law N° 60/2018 needs the complaint of the offended person (arts 35 and 37).
Frequently asked questions
Is a romance scam a crime in Rwanda?
Yes: obtaining another person's property or finances by using false names or qualifications, or by positive promises, is fraud under art. 174 of the Penal Code, with two to three years and a fine of FRW 3 million to 5 million; a fake online profile can also fall under art. 40 of Law N° 60/2018 (impersonation).
What is the penalty for phishing in Rwanda?
Art. 36 of Law N° 60/2018 sets one to two years and a fine of FRW 1,000,000 to 3,000,000 for using an electronic message or website to obtain confidential information with intent to steal money or gain access to a system.
Where do I report an online scam?
At a police station or to the Rwanda Investigation Bureau: call 166 or use the 'Report a case' portal on rib.gov.rw.
Sources
- Law N° 68/2018 of 30/08/2018 determining offences and penalties in general (Penal Code), Official Gazette Special of 27/09/2018 -- gazette copy published by Laws.Africa — arts 128, 129, 171 and 174 as published in 2018; arts 174, 129 and 171 are not among the articles amended in 2019 or 2023
- Law N° 69/2019 of 08/11/2019 amending Law N° 68/2018 of 30/08/2018 determining offences and penalties in general, Official Gazette Special of 29/11/2019 -- Ministry of Justice copy — list of articles amended in 2019 (60, 68, 92, 133, 136, 140, 154, 190, 233, 236, 263)
- Law N° 059/2023 of 04/12/2023 amending Law N° 68/2018 of 30/08/2018 determining offences and penalties in general, Official Gazette Special of 05/12/2023 -- gazette copy archived by Gazettes.Africa — list of articles amended in 2023 (35, 60, 64, 84, 92, 99, 100, 108, 117, 120, 121, 123, 133, 152, 172, 177, 218, 271, 291)
- Law N° 60/2018 of 22/08/2018 on prevention and punishment of cyber crimes, Official Gazette Special of 25/09/2018 -- gazette copy published by Laws.Africa — arts 21, 35 to 40 and 52
- Rwanda Investigation Bureau (RIB) -- home page: 'Report a case' portal and hotlines — 'Report a case' portal, awareness video on phone-based fraud, hotlines
- Rwanda Investigation Bureau (RIB) -- contact page: hotlines, headquarters, opening hours — hotline 166, address and hours
- National Cyber Security Authority (NCSA) -- official website: contact details — 'Report Incident' link and address
- Data Protection and Privacy Office (dpo.gov.rw) -- complaint and registration services, contacts — complaint email and toll-free number
- Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, Official Gazette Special of 15/10/2021 -- gazette copy archived by Gazettes.Africa — arts 56 and 59: unlawful access, sharing and sale of personal data
The general article: Romance scams · Compare with another country