According to a new law on protection of personal data and privacy, individuals and institutions that process personal data of individuals in Rwanda have the next 24 months beginning October this year to comply. The process will see firms and individuals collecting, accessing and using personal data set up mechanisms to seek consent to collect and process personal data, protect persons whose data they use, have more transparency among other developments. The new law also has special provisions to protect data of children, safeguarding against sensitive data such as health records. Further among other things, the new law makes it possible for members of the public to request companies and firms handling their data to request for access to their personal data as well as information relating to it. For errant persons and firms, the law outlines penalties for offences such as accessing, collecting, using, sharing, disclosing and selling of personal data in a way that is contrary to this regulation. These include, for individuals, up to 10 years imprisonment or up to Rwf 25M in fine while firms could face consequences including up to five per cent fine of annual turnover of the previous financial year. Victims who suffer serious damage due to violation of the law have the right to claim for compensation with a competent court. The law is timely as it comes at a time when it’s impossible to stop one’s personal data from being collected and processed. With the digital economy characterized by aspects such as e-commerce, international financial transactions among other services, data and information of persons can be accessible to entities including some who might use it for unlawful purposes. Compliance by firms operating in Rwanda will ensure safety especially with regard to minors who are increasingly using digital platforms as well as sensitive information. Compliance with the law could also see Rwanda better placed to participate in international trade and included in the global digital economy as stakeholders’ fears on their data will be allayed.
