Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data

Law N° 58/2021, arts. 9-12 (sensitive personal data, children's data and criminal records)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 October 2021.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Process sensitive personal data, including genetic or biometric information, race, health status, criminal records, religious or philosophical beliefs, political opinion, sexual life or family details, only on one of the five grounds article 10 lists, such as the data subject's consent, a vital interest, public health, or archiving, scientific or statistical purposes.
When processing sensitive personal data, build the capacity of staff involved, control who can access it, and apply technical and organisational measures appropriate to the risk, including storing it separately and applying tokenisation, pseudonymisation or encryption where appropriate.
Comply with the retention periods this Law sets for sensitive personal data.
Before processing personal data you know belongs to a child under sixteen, obtain the consent of a holder of parental responsibility over the child, unless the processing is necessary to protect the child's vital interest.
Process personal data of a convict only under the supervisory authority's supervision, and put in place safeguards to respect that data subject's rights and freedoms.

What it reaches

Obligation class

Consent, Biometric, Age verification, Access restriction, Security, Retention

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 9 requires the consent of a holder of parental responsibility before processing personal data belonging to a child under sixteen, permits that consent only where given in the child's interest, and dispenses with it where processing is necessary to protect the child's vital interest.

Article 10 permits processing sensitive personal data, defined at article 3 to include race, health status, criminal records, medical records, social origin, religious or philosophical beliefs, political opinion, genetic or biometric information, sexual life and family details, only on the data subject's consent, the controller's or processor's legal obligations, a vital interest, public health, or archiving, scientific, historical or statistical purposes.

Article 11 layers safeguards onto that processing: compliance with the sensitive-data retention periods this Law sets, staff-capacity building, controls on who may access it, and technical and organisational measures appropriate to the risk, including storing it separately from other data and applying tokenisation, pseudonymisation or encryption.

Article 12 places processing personal data of a convict, whose criminal record is itself a category of sensitive personal data, under the supervisory authority's supervision, and requires safeguards for that data subject's rights and freedoms.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
serves_minors
handles_health_records

Read the law

Law relating to the Protection of Personal Data and Privacy, RwandaLII (Official Gazette special of 15 October 2021)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app