The framework
Rwanda regulates personal data through Law No. 058/2021 on Personal Data Protection and Privacy, supervised by the National Cyber Security Authority.
For advertisers the consent posture matters most, and Rwanda sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Law No. 058/2021 on Personal Data Protection and Privacy
Rwanda's 2021 law came with a hard edge, including a store-in-Rwanda default absent NCSA authorization, active registration enforcement since the 2023 transition ended, and a security-agency regulator.
Marketing and advertising
Consent or listed bases; registration of controllers and processors required. Most channel decisions here follow from that consent rule.
Cross-border transfers
Data must be stored in Rwanda unless the NCSA authorizes transfer, a notable localization default.
Enforcement and penalties
Fines up to RWF 5M or 1% of turnover, plus criminal exposure.