It is now almost two years since Law No. 058/2021 of October 13,
2021, on the protection of personal data and privacy (the
"Data Protection Act" or
"DPA" or
"DPP") came into force, subject to a
grace period of two years. This period ends on 15 October 2023,
leaving only four days to comply. The DPA sets out a comprehensive
framework for the protection of personal data, and this
comprehensive and far-reaching new law applies to all organisations
that collect or process personal data in Rwanda. This is especially
important for organisations that conduct business in Rwanda and
process the personal information of Rwandans, with significant
fines being imposed should they be found to be non-compliant.
