Law relating to the Protection of Personal Data and Privacy, rights of the data subject

Law N° 58/2021, arts. 18-26 and 42 (rights of the data subject and the information notice)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 October 2021.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

On a data subject's written or electronic request, provide the purposes of processing, a copy of their personal data, a description of what you hold including third-party recipients, the source of data not obtained from them, and whether it was transferred to a third country or an international organisation, subject to the listed exceptions such as another person's rights, legal privilege, or confidential examination materials.
Within thirty days of a request to object, port, erase or rectify personal data, tell the data subject in writing or electronically whether you complied and, if not, why, and expect the supervisory authority to answer an appeal against your response within sixty days.
Stop processing a data subject's personal data on their objection, including for direct marketing or related profiling, unless you can demonstrate compelling legitimate grounds that override their interests, rights and freedoms.
On request, resend a data subject's personal data in a structured, readable format, or transmit it directly to another data controller where technically feasible.
Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal or other significant consequences for them, unless their explicit consent, contract necessity, or an authorising law with safeguards applies.
Restrict processing at a data subject's or the supervisory authority's request while accuracy is contested, an objection is under review, or unlawful processing is alleged, and tell the data subject before lifting a restriction imposed because processing was unlawful.
Erase a data subject's personal data on request where it is no longer necessary, consent has been withdrawn, they object, or it was unlawfully processed, and tell any third party you disclosed it to, or posted it publicly, that erasure was requested.
Before or when collecting personal data, tell the data subject your identity and contact details, the purposes and recipients, whether provision is mandatory, their rights including to withdraw consent, access, rectify, restrict, erase, object and appeal, the retention period, and the existence and consequences of any automated decision making.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Articles 18 to 26 give the data subject rights of access, objection, portability, rectification, erasure, restriction of processing, and, at article 21, the right not to be subject to a decision based solely on automated personal data processing, including profiling, that may produce legal or other significant consequences for them, subject to listed exceptions including the data subject's explicit consent, contract necessity, or an authorising law with safeguards.

Article 22 lets the data subject or the supervisory authority restrict processing while accuracy, lawfulness, or an objection is being resolved, article 25 excludes personal data from succession except by will, and article 26 lets a minor, a person with a physical or mental impairment, or anyone else designate a representative to exercise these rights.

A data subject dissatisfied with a controller's or processor's response to an objection, portability, erasure, or rectification request may appeal to the supervisory authority within thirty days, which must answer the appeal within sixty days.

Article 42 requires the data controller, when collecting personal data, to give the data subject an information notice covering identity and contact details, the purposes and recipients of processing, whether provision of the data is mandatory, the existence and consequences of automated decision making, the retention period, and the rights this Law gives the data subject, including the right to withdraw consent and to appeal to the supervisory authority.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Law relating to the Protection of Personal Data and Privacy, RwandaLII (Official Gazette special of 15 October 2021)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app