Law relating to the Protection of Personal Data and Privacy, cross-border transfer and data storage

Law N° 58/2021, arts. 48-50 (cross-border transfer and data localisation)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 October 2021.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not share or transfer personal data to a third party outside Rwanda unless you have the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, or another listed ground such as contract necessity, public interest, a legal claim, or a ratified international instrument.
Enter into a written contract with anyone you authorise to access, share or transfer personal data outside Rwanda, setting out each party's respective roles and responsibilities.
Store personal data in Rwanda, and store it outside Rwanda only where you hold a valid registration certificate from the supervisory authority authorising storage abroad.
Be ready to demonstrate compliance with the transfer safeguards this Law requires, including where a transfer rests on your own compelling legitimate interests, and expect the supervisory authority to prohibit or suspend an outbound transfer to protect data subjects' rights.

What it reaches

Obligation class

Transfer, Access restriction, Contract terms

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 48 permits a data controller or data processor to share or transfer personal data to a third party outside Rwanda only on a listed ground: the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, contractual necessity, public interest, the establishment or defence of a legal claim, protecting a vital interest, the controller's or processor's own compelling legitimate interests where the transfer is not repetitive and safeguards have been assessed, or performance of an international instrument Rwanda has ratified.

Article 49 requires a written contract with anyone authorised to access, share or transfer personal data outside Rwanda, and lets the supervisory authority demand proof of compliance or prohibit or suspend a transfer to protect data subjects' rights. Article 50 requires personal data to be stored in Rwanda, permitting storage abroad only where the controller or processor holds a valid registration certificate from the supervisory authority authorising it.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics

Read the law

Law relating to the Protection of Personal Data and Privacy, RwandaLII (Official Gazette special of 15 October 2021)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app