Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offences

Article 27 tasks the supervisory authority with overseeing the Law's implementation, responding to requests for an opinion, informing data subjects, controllers, processors and third parties of their rights and obligations, keeping the register of data controllers and processors, investigating and deciding complaints, and cooperating with domestic and foreign counterparts, and article 28 gives it the power to issue registration certificates, ensure compliance, protect public freedoms and privacy from information and communication technologies, make regulations, and impose administrative sanctions.

Article 53 sets an administrative fine, for an individual, of between two million and five million Rwandan francs or one percent of the preceding financial year's global turnover for listed misconducts including failure to maintain records, log processing, register, report a certificate change, designate a data protection officer, or notify, report or communicate a breach, and one percent of global turnover alone for a corporate body or legal entity, with article 54 letting anyone dissatisfied with an administrative sanction apply to the competent court and article 55 depositing the fine with the Public Treasury.

Articles 56 to 61 create separate criminal offences, each with its own imprisonment and fine range, for unlawfully accessing, using, sharing, transferring or disclosing personal data, re-identifying de-identified data, destroying, erasing, concealing or altering data, selling data, unlawfully collecting or processing sensitive personal data, and providing false registration information, article 62 fines a corporate body or legal entity convicted of any of those offences five percent of its preceding financial year's annual turnover, and article 63 lets the court order seizure or confiscation of items and proceeds and the permanent or temporary closure of the offending entity or premises.

Article 64 makes the supervisory authority the organ that settles conflicts arising under this Law in the first instance, subject to a party's right to take an unresolved conflict to a competent court, and article 65 gives a person who suffers serious damage from a controller's or processor's violation of this Law the right to claim compensation before a competent court, unless the controller or processor proves it was not responsible for the damage.