Rwanda

Article 4 requires a written contract between a data controller and a data processor before the processor may process personal data on the controller's behalf.

Article 6 requires the data subject's consent to be demonstrated where consent is the ground for processing, article 9 requires the consent of a holder of parental responsibility to process a child's personal data unless necessary to protect the child's vital interest, and article 10 permits processing sensitive personal data, including genetic or biometric information, only on consent, a legal obligation, a vital interest, public health, or archiving, scientific, or statistical grounds, with article 11 adding safeguards including capacity-building for staff and access controls.

Articles 18 to 24 give the data subject rights of access, objection, portability, rectification, and erasure, and article 21 gives the data subject the right not to be subject to a decision based solely on automated personal data processing, including profiling, that may produce legal or significant consequences for them, subject to listed exceptions including the data subject's explicit consent or contract necessity.

Articles 29 to 36 require registration as a data controller or data processor with the supervisory authority, and article 40 requires designation of a data protection officer where the controller or processor is a public or private corporate body, carries out large-scale systematic monitoring, or processes sensitive personal data or criminal-conviction data on a large scale.

Articles 43 to 45 require the data controller to notify the supervisory authority of a personal data breach, report on it, and communicate it to the data subject where it is likely to result in a high risk to their rights and freedoms.

Article 47 requires appropriate technical and organisational security measures, article 48 requires a supervisory-authority authorisation, the data subject's consent, or another listed ground before personal data is shared or transferred to a third party outside Rwanda, and article 50 requires personal data to be stored in Rwanda unless the controller or processor holds a valid registration certificate authorising storage abroad.

Article 53 sets an administrative fine, for an individual, of between two million and five million Rwandan francs or one percent of the preceding financial year's global turnover for listed administrative misconducts including failure to register, failure to designate a data protection officer, or failure to notify a breach, and one percent of global turnover alone for a corporate body or legal entity.

Articles 56 to 61 create separate criminal offences, each with its own imprisonment and fine range, for unlawfully accessing, using, sharing, or disclosing personal data, re-identifying de-identified data, destroying or altering data, selling data, unlawfully collecting or processing sensitive personal data, and providing false registration information, and article 62 fines a corporate body or legal entity convicted of any of those offences five percent of its preceding financial year's annual turnover.

Article 65 gives a person who suffers serious damage from a controller's or processor's violation of the Law the right to claim compensation before a competent court.

Article 16 makes it an offence for a person to intentionally and unlawfully get access to computer or computer system data where the person does not have consent from someone entitled to give it, is not entitled to control or access the data, or accesses another person's computer system without authorization to know recorded or transmitted data, by any means and regardless of location. The offence carries imprisonment of six months to two years and a fine of RWF 1,000,000 to 2,000,000.

None of article 16's three grounds requires infringing a technical security measure; each turns instead on the absence of consent, entitlement, or authorization.

Article 3 applies these instructions to any person or organisation that broadcasts or provides content online or provides access to online content, a scope not confined to services aimed at children or to social media platforms.

Article 4 requires digital content providers and retailers to make available digital content filtering tools, maintain plans to manage harmful online content, provide a reporting function for users, give a clear external label describing whether platform content is suitable for children, and put in place a mechanism to prevent children from accessing age-inappropriate content, sites, products, or interactive services.

Article 5 requires internet service providers to inform subscribers of risks to children, support reporting of child abuse, block access to child-abuse material once identified, and make parental-control tools available where applicable. Article 6 requires cybercafes and public Wi-Fi providers in public places to proactively block access to sites known for hosting content harmful to children.

Article 7 requires broadcasters and television service providers to indicate the suitability of content for various age categories. It also requires them to implement technical barriers, including parental controls and age-verification tools, so that children are not exposed to harmful content.

Article 8 requires social media users to self-regulate by refraining from creating or publishing videos of child actors in age-inappropriate roles, and from creating or publishing children's images or videos for entertainment or commercial purposes without the consent of a holder of parental responsibility.

The instructions themselves do not define the term child; they are issued pursuant to Law N° 71/2018 relating to the Protection of the Child, which defines a child as any person under eighteen years of age.

Article 198 excludes published daily news or news communicated to the public, official legislative, administrative, or judiciary texts, and mere ideas, procedures, systems, methods, concepts, principles, or discoveries from copyright protection: a bare news item is never a protected work under Rwandan law, whichever outlet reports it first.

Article 209 separately permits, without the author's authorization and without payment of remuneration, subject to indicating the source and the author's name as far as practicable: the reproduction in a newspaper or periodical, or the broadcasting or other communication to the public, of an article published in a newspaper or periodical on current economic, political, or religious topics, or a broadcast work of the same character, where the right to reproduction, broadcasting, or communication to the public is not expressly reserved; the reproduction or communication to the public, for the purpose of reporting short current events, of a work seen or heard in the course of those events, to the extent justified by the informatory purpose; and the reproduction, broadcasting, or communication to the public of a political speech, lecture, address, sermon, or similar public address, or a speech delivered during legal proceedings, to the extent justified by the purpose of providing current information.

Article 205 separately permits free reproduction in the form of quotation of a short part of a published work, without authorization or payment, provided the reproduction is compatible with fair practice and does not exceed the extent justified by the purpose, and is accompanied by an indication of source and the author's name where it appears in the work quoted.

None of these three provisions is capped at a headline-length threshold distinct from the fair-practice and informatory-purpose tests they each already carry.