Rwanda
Law No. 058/2021 relating to the Protection of Personal Data and Privacy
Authority
National Cyber Security Authority (NCSA) / Data Protection Office
Overview
Rwanda’s Law No. 058/2021 on the Protection of Personal Data and Privacy, in force since 15 October 2021, is one of Africa’s most demanding data protection statutes on paper. Its most distinctive feature is Article 40, which mandates the designation of a Data Protection Officer for any processing of personal data—not merely for public authorities or large-scale processors as under the GDPR . Failure to appoint a DPO constitutes an administrative misconduct subject to fines . The supervisory authority is the National Cyber Security Authority (NCSA), a cybersecurity agency rather than an independent data protection commission . Cross-border transfers require NCSA authorisation, and personal data must be stored in Rwanda by default unless a storage-abroad certificate is obtained . Penalties reach RWF 5 million or 1% of global annual turnover for administrative violations, rising to 5% of turnover for criminal convictions . However, as of late 2026, no published enforcement decisions had been identified, raising questions about the NCSA’s practical enforcement capacity . Rwanda’s framework is ambitious in scope but remains in an early stage of regulatory maturity.