--- title: "Rwanda Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/rwanda/ source_html: /jurisdictions/rwanda/index.html description: "Rwanda data protection and privacy regulation: 10 categories, 67 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: ffa0b0d2343a7ea40c1ed8893d64843cc8f0b4980cd252eb00ff4f2a6f22326c generator: "fe-fleet/md-twin@1.0" --- # Rwanda Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Rwanda Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 67 claims · 32 sources in the cumulative register Download report (PDF) Expand all Rwanda's Law N°058/2021 is understood to apply extraterritorially, covering a data controller, processor, or third party that is neither established nor resident in Rwanda but that processes the personal data of data subjects located in Rwanda. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Sectoral Watch. Not fully checked this cycle: Cross-Border & Adequacy, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=RWANDA)[Build Report](/reports/?j=RWANDA)[Compare](/compare/?j=RWANDA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority National Cyber Security Authority (NCSA) - Data Protection and Privacy Office Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 2 Red categories 57 Sub-modules 67 Claims 2 Tier-1 sources Traffic-light mix 7 amber 1 green 2 red (sums to 10 rendered categories; click to filter) 2 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,223 Full executive summary 877 ###### Latest update · 25 October 2026 #### Lead Signal Rwanda's National Cyber Security Authority ran its 2026 Data Privacy Week from 26 to 30 January 2026 under the theme "Compliance is Beyond Registration, it's a Continuous Journey," a messaging choice that signals the regulator views initial DPP-certificate registration as the floor of compliance rather than its ceiling. Read alongside the standing registration-enforcement regime, under which operating without a Data Protection and Privacy certificate can draw an administrative fine of between RWF 2 million and 5 million or one percent of the prior year's global turnover, the campaign indicates a supervisory authority maintaining active enforcement messaging even in a cycle without a published individual enforcement decision. #### Other Developments Unreconciled penalty figures. A separate secondary source describes a maximum administrative fine of one percent of global turnover of the preceding financial year and a maximum criminal fine of five percent of annual turnover of the previous financial year under Law N°058/2021's penalty provisions. Whether this is the same penalty regime as the RWF 2-5 million or one-percent-turnover registration fine, or a distinct and more severe provision applicable to different conduct, is not resolved in the sourcing available, and the two figures should be treated as potentially overlapping rather than confirmed as identical. Sustained registration-enforcement posture. The NCSA's own published materials and third-party commentary through September 2026 continue to frame registration enforcement as an ongoing priority, reinforcing that supervisory attention to this area has not lapsed since the DPP-certificate regime took effect. #### Cross-Monitor Connections The financial dimension of Rwanda's data-protection penalty regime, expressed as a percentage of global turnover, connects to financial-integrity's interest in corporate-transparency and beneficial-ownership frameworks insofar as turnover-based penalties depend on accurate corporate financial reporting. The absence of a published individual enforcement decision, despite active enforcement messaging, is also a signal relevant to world-payments' assessment of Rwanda's broader regulatory-enforcement credibility for firms operating payment and data-processing functions in the jurisdiction. #### Outlook The principal open question for Rwanda's enforcement posture is whether the NCSA will reconcile the two differently stated penalty figures, or whether a future primary-source retrieval will show them to be distinct provisions applying to different categories of conduct. Continued Data Privacy Week-style messaging suggests the NCSA intends to sustain public pressure toward full compliance beyond registration, though no additional published enforcement action was identified. 3 earlier updates not shown here. ###### Standing brief · as of 26 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Rwanda's Law N°058/2021 is understood to apply extraterritorially, covering a data controller, processor, or third party that is neither established nor resident in Rwanda but that processes the personal data of data subjects located in Rwanda. Commentary reviewed alongside the primary statutory text describes this as broader than the GDPR's territorial test, which requires an offering of goods or services or behavioural monitoring before extraterritorial reach attaches. This cycle resolves what had been an unconfirmed gap in Rwanda's territorial-scope coverage, corrected against primary text hosted by the Rwanda Legal Information Institute. #### Other Developments Rwanda's National Cyber Security Authority (NCSA) operates as the country's data-protection supervisory authority through its Data Protection and Privacy Office, a structure the NCSA has held since its establishment in 2017. Law N°058/2021 is Rwanda's in-force omnibus data-protection statute. The law classifies personal data into sensitive and non-sensitive categories, with differentiated processing rules attaching to each. Chapter IV, Articles 30 through 36, establishes a controller/processor registration regime covering application, certificate issuance, renewal, cancellation or modification, and a public register. Chapter II establishes general rules for collecting and processing personal data anchored on a consent article, Article 7, supplemented by Article 11 grounds for sensitive-data processing. A data subject holds a full right to withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing, and the data subject must be informed before consent is given. Articles 11 through 13 impose distinct grounds and safeguards for sensitive personal data and criminal-conviction data processing. Article 23 is understood to grant a right to information, functioning as Rwanda's access-right analogue within Chapter III. Article 25 grants a right of rectification or erasure, and Article 26 grants a right to data portability. A data subject can object to processing likely to cause loss, sadness or anxiety, under Article 24. Separately, under the same Article 24 mechanism, a data subject can object to processing for direct-marketing purposes, including profiling to the extent related to such marketing. A data controller or processor must respond within 30 days of receipt of an objection request, either complying or giving reasons for non-compliance, with a further 30-day window for the data subject to appeal to the NCSA. Article 44 establishes a security-of-processing obligation for data controllers and processors, complemented by an Article 45 prior security check requirement, though a dedicated GDPR-style DPIA mechanism by that name could not be confirmed in the text reviewed. Articles 40 and 41 impose a two-stage breach obligation: notification to the NCSA and communication to affected data subjects, though a specific statutory notification timeline could not be confirmed. Articles 42, 58 and 59 contain a dedicated retention provision, a duty to destroy personal data, and rules on data migration or treatment after business closure or change. Articles 54 through 56 govern transfer and sharing of personal data outside Rwanda, data hosting, and a distinctive Data Embassy mechanism. Article 53 suggests a qualified data-localisation or authorization posture for outbound transfers, though the precise scope remains unconfirmed. Reports suggest Article 10 may require that child's-data processing be lawful only where the child is at least 18 years old, or below that age only with the consent of the holder of parental responsibility, though this age threshold is sourced from a superseded draft regulation rather than confirmed against the final enacted text. The NCSA may impose administrative sanctions under Article 64 while respecting rights of defence, transparency, impartiality and non-discriminatory procedure. Article 65 penalizes unlawful obtaining, processing, disclosure or procurement of disclosure of personal data with a fine of not less than 5,000,000 RWF and not exceeding 10,000,000 RWF. Any person may lodge a complaint with the NCSA alleging infringement of rights or violation of the law, with an appeal to the courts within 30 working days of notice of the decision. The Government of Rwanda is understood to have approved a National Data Sharing Policy, supported by seven annexes, formalizing intergovernmental government-to-government data-sharing governance. #### Cross-Monitor Connections Article 27 addresses automated individual decision-making, providing Rwanda's closest analogue to a GDPR Article 22-style protection. This provision carries AI-Act-adjacent significance for algorithmic-governance oversight; readers tracking automated-decision-making regulation should also consult the artificial-intelligence monitor for the AI-regulation-first framing of the same provision. #### Outlook The bulk of this cycle's claims rest on a single T1 or T2 citation apiece, and the core statutory PDF mirror underwriting most of them carries title metadata suggesting an earlier or unfinalised draft rather than the promulgated Official Gazette text — both queued for verification before these ratings are treated as fully corroborated. Sectoral overlays for finance, health, telecoms, employment, credit, education and insurance show no confirmed instrument distinct from the general omnibus law, a gap treated as evidentiary rather than as proof of regulatory absence. DPIA methodology, DPO-appointment thresholds, records-of-processing obligations, joint-controller specifics, and case-level enforcement-activity data all remain unconfirmed heading into the next research cycle. Read full brief · 1223 words ###### Latest update · 28 September 2026 #### Regulatory Status Rwanda's data-protection regime remains anchored in Law N058/2021, operated by the National Cyber Security Authority's Data Protection Office. This cycle's developments centre on operative mechanics: a confirmed data-localisation-by-default posture requiring domestic storage of personal data absent a valid registration certificate authorising transfer or storage abroad, and an identical registration-certificate mechanism gating cross-border transfer under Article 50. The NCSA's Data Protection Office also ran a five-day ISO 31000 risk-management training for DPOs between 27 and 31 July 2026, and the standing penalty framework for unregistered operation, a fine of RWF 2 to 5 million or 1% of prior-year revenue, plus custodial penalties for false registration, remains in force. #### Outlook Watch for a first documented NCSA enforcement decision applying the standing penalty framework, and for any NCSA guidance clarifying the registration-certificate process underlying both the localisation and cross-border transfer mechanisms. 1 earlier update not shown here. ###### Standing brief · as of 26 August 2026 #### Regulatory Status Rwanda's National Cyber Security Authority (NCSA) operates as the country's data-protection supervisory authority through its Data Protection and Privacy Office, a structure the NCSA has held since its establishment in 2017. Law N°058/2021 is Rwanda's in-force omnibus data-protection statute. The law classifies personal data into sensitive and non-sensitive categories, with differentiated processing rules attaching to each. The law is understood to apply extraterritorially, covering a data controller, processor, or third party neither established nor resident in Rwanda but processing personal data of data subjects located in Rwanda — a scope commentary describes as broader than the GDPR's territorial test, which requires an offering of goods or services or behavioural monitoring before extraterritorial reach attaches. Chapter II of Law N°058/2021 establishes general rules for collecting and processing personal data anchored on a consent article, Article 7, supplemented by Article 11 grounds for sensitive-data processing. A data subject holds a full right to withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing, and the data subject must be informed before consent is given. Articles 11 through 13 impose distinct grounds and safeguards for sensitive personal data and criminal-conviction data processing. Article 23 is understood to grant a right to information, functioning as Rwanda's access-right analogue within Chapter III. Article 25 grants a right of rectification or erasure, and Article 26 grants a right to data portability. A data subject can object to processing likely to cause loss, sadness or anxiety, or to processing for direct-marketing purposes including related profiling, under Article 24. A data controller or processor must respond within 30 days of receipt of an objection request, either complying or giving reasons for non-compliance, with a further 30-day window for the data subject to appeal to the NCSA. Article 44 establishes a security-of-processing obligation for data controllers and processors, complemented by an Article 45 prior security check requirement, though a dedicated GDPR-style DPIA mechanism by that name could not be confirmed in the text reviewed. Articles 40 and 41 impose a two-stage breach obligation: notification to the NCSA and communication to affected data subjects, though a specific statutory notification timeline could not be confirmed. Articles 42, 58 and 59 contain a dedicated retention provision, a duty to destroy personal data, and rules on data migration or treatment after business closure or change. Articles 54 through 56 govern transfer and sharing of personal data outside Rwanda, data hosting, and a distinctive Data Embassy mechanism. Article 53 suggests a qualified data-localisation or authorization posture for outbound transfers, though the precise scope remains unconfirmed. Article 27 addresses automated individual decision-making, providing Rwanda's closest analogue to a GDPR Article 22-style protection; this provision also functions as Rwanda's closest analogue to profiling-specific restrictions. Reports suggest Article 10 of Law N°058/2021 may require that child's-data processing be lawful only where the child is at least 18 years old, or below that age only with the consent of the holder of parental responsibility, though this age threshold is sourced from a superseded draft regulation rather than confirmed against the final enacted text. The NCSA may impose administrative sanctions under Article 64 while respecting rights of defence, transparency, impartiality and non-discriminatory procedure. Article 65 penalizes unlawful obtaining, processing, disclosure or procurement of disclosure of personal data with a fine of not less than 5,000,000 RWF and not exceeding 10,000,000 RWF. Any person may lodge a complaint with the NCSA alleging infringement of rights or violation of the law, with an appeal to the courts within 30 working days of notice of the decision. Separately, the Government of Rwanda is understood to have approved a National Data Sharing Policy, supported by seven annexes, formalizing intergovernmental government-to-government data-sharing governance. #### Outlook Most of this cycle's claims rest on a single T1 or T2 citation, and the core statutory PDF mirror carries title metadata suggesting an earlier or unfinalised draft rather than the promulgated Official Gazette text — both queued for verification. Sectoral overlays for finance, health, telecoms, employment, credit, education and insurance, DPIA methodology, DPO-appointment thresholds, records-of-processing obligations, joint-controller specifics, the precise breach-notification timeline, adequacy decisions or SCC/BCR-style transfer mechanisms, AI-specific and biometric-data regimes, and case-level enforcement-activity data all remain unconfirmed heading into the next research cycle. Read full brief · 877 words Key regulatory facts for Rwanda Regulatory Dimension Rwanda Standing Position Jurisdiction Rwanda (RW) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 67 sourced findings) Regulator & Framework Core instrument, regulator and registration mechanics are well evidenced (T1); territorial-scope provisions are unconfirmed, holding the module at amber pending primary-text verification. Lawful Processing & Special Data Lawful-basis, consent and special-category provisions are well evidenced (T1); pseudonymisation/anonymisation treatment is an unconfirmed gap. Data Subject Rights Rights catalogue and a concrete statutory/administrative deadline are confirmed by T1 statute text and T2 regulator guidance. Controller/Processor Duties Security and breach provisions are strongly evidenced (T1); DPIA/DPO/ROPA/joint-controller specifics remain gaps pending fuller primary-text review. Primary Instruments Cited National Cyber Security Authority, OneTrust DataGuidance, DataGuidance (mirror of Official Gazette text), National Cyber Security Authority (NCSA), DLA Piper Last Confirmed / Updated 2026-11-04 (32 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Rwanda: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core instrument, regulator and registration mechanics are well evidenced (T1); territorial-scope provisions are unconfirmed, holding the module at amber pending primary-text verification. Primary framework Law N°058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Amber Core instrument, regulator and registration mechanics are well evidenced (T1); territorial-scope provisions are unconfirmed, holding the module at amber pending primary-text verification. #### Sub-modules (5) #### Regulator And AuthorityGreen NCSA, established in 2017, houses the Data Protection and Privacy Office as Rwanda's operative supervisory authority for data protection matters. Claims (6): - The National Cyber Security Authority (NCSA), a government institution established in 2017, houses the Data Protection and Privacy Office and functions as Rwanda's operative data-protection supervisory authority. - NCSA is designated as Rwanda's data-protection supervisory authority under Law No. 058/2021. - Data Protection and Privacy Office (NCSA) — The Data Protection and Privacy Office within NCSA is the supervisory authority for Rwanda's data protection law and conducts ongoing DPO capacity-building, e.g. a 5-day ISO 31000 risk-management training, 27-31 July 2026. - National Cyber Security Authority (NCSA) — NCSA officially operates a dedicated Data Protection Office (DPO) to implement Law N058/2021. - National Cyber Security Authority (Rwanda) — Primary national-level responsibility for privacy and personal-data protection, with administrative and financial autonomy - National Cyber Security Authority (NCSA) — The NCSA's Data Protection and Privacy Office is the supervisory authority and the initial organ for settling conflicts arising under the Data Protection Law. #### Act And InstrumentsGreen Law N°058/2021 is the core, currently-in-force statute. Claims (5): - Law N°058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy is Rwanda's core, in-force data-protection statute. - Law N°058/2021 of 13/10/2021 is the governing data-protection statute, in effect since 15 October 2021. - Law N058/2021 — Rwanda's Personal Data Protection and Privacy Law was gazetted 15 October 2021 with a 24-month implementation transition ending 15 October 2023. - Law N°058/2021 relating to the Protection of Personal Data and Privacy — Gazetted 15 October 2021; designates NCSA as the data-protection supervisory authority - Law N°058/2021 relating to the protection of personal data and privacy is Rwanda's governing data-protection statute, in force since 15 October 2021. #### Material ScopeGreen The law classifies personal data as sensitive or non-sensitive, with differentiated obligations attaching to each class. Claims (1): - The law classifies personal data into sensitive and non-sensitive categories, with differentiated processing rules attaching to each classification. #### Territorial ScopeGreen Law N°058/2021 applies extraterritorially: it covers a data controller, processor, or third party neither established nor resident in Rwanda but processing personal data of data subjects located in Rwanda, a scope commentary describes as broader than the GDPR test (no goods/services-offering or behavioural-monitoring requirement). Claims (5): - Law N°058/2021 — Individuals and institutions established or residing outside Rwanda that process the personal data of individuals in Rwanda - Foreign controllers/processors handling Rwanda-located individuals' data must appoint a local representative. #### Regulator Registration And FilingGreen Chapter IV of the law (Articles 30-36) establishes registration of controllers/processors, certificate issuance, renewal, cancellation and a public register. Claims (4): - Chapter IV of the law establishes a registration regime for data controllers and processors covering application for registration, issuance of a registration certificate, renewal, cancellation/modification and a public register of controllers and processors. - National Cyber Security Authority — NCSA issues a registration certificate to a compliant data-controller/processor applicant within thirty (30) working days. - Rwanda data controllers and processors — DPP certificate from NCSA within 30 working days of application, free of charge; breach can draw an administrative fine of RWF 2-5 million or 1% of prior-year global turnover - Rwandan data controllers and processors — Every data controller and processor must register and obtain a DPP certificate, issued by the NCSA within 30 working days of application, with no registration fee. Rwanda's data-protection regime is anchored in Law N°058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy, a comprehensive GDPR-influenced statute supervised by the Data Protection and Privacy Office within the National Cyber Security Authority (NCSA). The law establishes a registration regime for controllers/processors and classifies personal data into sensitive and non-sensitive categories. Territorial-scope specifics (application to non-established/foreign controllers) could not be confirmed from located sources and are flagged as a gap. No periodic updates recorded in this cycle Sources and claims (18) - [National Cyber Security Authority](https://ncsa.gov.rw/about-ncsa) — The National Cyber Security Authority (NCSA), a government institution established in 2017, houses the Data Protection and Privacy Office and functions as Rwanda's operative data-protection supervisory authority. - [OneTrust DataGuidance](https://www.dataguidance.com/news/rwanda-ncsa-publishes-guidance-right-object) — Law N°058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy is Rwanda's core, in-force data-protection statute. - [DataGuidance (mirror of Official Gazette text)](https://www.dataguidance.com/sites/default/files/30802b_965abe73ea2e48899a28a4aefe2d3705.pdf) — The law classifies personal data into sensitive and non-sensitive categories, with differentiated processing rules attaching to each classification. - [DataGuidance (mirror of Official Gazette text)](https://www.dataguidance.com/sites/default/files/30802b_965abe73ea2e48899a28a4aefe2d3705.pdf) — Chapter IV of the law establishes a registration regime for data controllers and processors covering application for registration, issuance of a registration certificate, renewal, cancellation/modification and a public register of controllers and processors. - [National Cyber Security Authority (NCSA)](https://cyber.gov.rw/updates/article/ncsa-officially-launches-its-data-protection-office/) — NCSA is designated as Rwanda's data-protection supervisory authority under Law No. 058/2021. - [National Cyber Security Authority (NCSA)](https://cyber.gov.rw/updates/article/ncsa-officially-launches-its-data-protection-office/) — Data Protection and Privacy Office (NCSA) — The Data Protection and Privacy Office within NCSA is the supervisory authority for Rwanda's data protection law and conducts ongoing DPO capacity-building, e.g. a 5-day ISO 31000 risk-management training, 27-31 July 2026. - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=about&c=RW) — Law N°058/2021 of 13/10/2021 is the governing data-protection statute, in effect since 15 October 2021. - [Minute Privacy (deepidv)](https://www.deepidv.com/media/minutes/rwanda-ncsa-data-protection-registration-enforcement-2026) — National Cyber Security Authority — NCSA issues a registration certificate to a compliant data-controller/processor applicant within thirty (30) working days. - [National Cyber Security Authority (NCSA)](https://cyber.gov.rw/updates/article/ncsa-officially-launches-its-data-protection-office/) — National Cyber Security Authority (NCSA) — NCSA officially operates a dedicated Data Protection Office (DPO) to implement Law N058/2021. - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=about&c=RW) — Law N058/2021 — Rwanda's Personal Data Protection and Privacy Law was gazetted 15 October 2021 with a 24-month implementation transition ending 15 October 2023. - [NCSA](https://cyber.gov.rw/index.php?eID=dumpFile&t=f&f=427&token=6375c4cab9b091a9747cd9f07f8dc616ba825245) — National Cyber Security Authority (Rwanda) — Primary national-level responsibility for privacy and personal-data protection, with administrative and financial autonomy - [National Cyber Security Index](https://ncsi.ega.ee/country/rw/) — Law N°058/2021 relating to the Protection of Personal Data and Privacy — Gazetted 15 October 2021; designates NCSA as the data-protection supervisory authority - [dataprotection.africa](https://dataprotection.africa/rwanda/) — Law N°058/2021 — Individuals and institutions established or residing outside Rwanda that process the personal data of individuals in Rwanda - [https://www.deepidv.com/media/minutes/rwanda-ncsa-data-protection-registration-enforcement-2026](https://www.deepidv.com/media/minutes/rwanda-ncsa-data-protection-registration-enforcement-2026) — Rwanda data controllers and processors — DPP certificate from NCSA within 30 working days of application, free of charge; breach can draw an administrative fine of RWF 2-5 million or 1% of prior-year global turnover - [DLA Piper](https://www.dlapiperdataprotection.com/guide.pdf?c=RW) — National Cyber Security Authority (NCSA) — The NCSA's Data Protection and Privacy Office is the supervisory authority and the initial organ for settling conflicts arising under the Data Protection Law. - [DLA Piper](https://www.dlapiperdataprotection.com/guide.pdf?c=RW) — Law N°058/2021 relating to the protection of personal data and privacy is Rwanda's governing data-protection statute, in force since 15 October 2021. - [Creodata](https://www.creodata.com/blog/fic-goaml-registration-rwanda/) — Rwandan data controllers and processors — Every data controller and processor must register and obtain a DPP certificate, issued by the NCSA within 30 working days of application, with no registration fee. - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=about&c=RW) — Foreign controllers/processors handling Rwanda-located individuals' data must appoint a local representative. ### Rwanda: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Lawful-basis, consent and special-category provisions are well evidenced (T1); pseudonymisation/anonymisation treatment is an unconfirmed gap. Primary framework Law N°058/2021, Chapter II Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Amber Lawful-basis, consent and special-category provisions are well evidenced (T1); pseudonymisation/anonymisation treatment is an unconfirmed gap. D2 · Lawful Processing — Full Module Record 4 sub-modules · 41 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Rwanda: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Uncertain▾ Rights catalogue and a concrete statutory/administrative deadline are confirmed by T1 statute text and T2 regulator guidance. Primary framework Law N°058/2021, Chapter III Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Green Rights catalogue and a concrete statutory/administrative deadline are confirmed by T1 statute text and T2 regulator guidance. #### Sub-modules (5) #### Access RightAmber Article 23 provides a 'right to information', operating as Rwanda's access-right analogue within Chapter III. Claims (1): - Chapter III of the law grants data subjects a right to information (Article 23), which functions as Rwanda's access-right analogue within the omnibus statute. #### Rectification And ErasureGreen Article 25 provides a right of rectification or erasure. Claims (1): - Data subjects hold a right of rectification or erasure under Article 25 of the Data Protection Law. #### Restriction And ObjectionGreen Article 24 provides a right to object, including where processing is likely to cause loss, sadness or anxiety, or is for direct-marketing purposes including related profiling. Claims (1): - A data subject can object to personal data processing where the processing is likely to cause loss, sadness, or anxiety, or where personal data are processed for direct marketing purposes, including related profiling. #### Data PortabilityGreen Article 26 provides a right to data portability. Claims (1): - The law provides a right to data portability under Article 26 of Chapter III. #### Deadlines And Response WindowsGreen NCSA guidance specifies a 30-day controller/processor response window on an objection request, with a further 30-day window for the data subject to appeal an unsatisfactory response to the NCSA. Claims (1): - A data controller or processor must, within 30 days of receipt of an objection request, inform the data subject in writing or electronically of compliance or reasons for non-compliance; a dissatisfied data subject may appeal to the NCSA within 30 days of receiving that response. Chapter III of the law (Articles 23-29) enumerates a right to information, right to object, right of rectification or erasure, right to data portability, protections against solely-automated decision-making, exercise of rights by representation, and treatment of a deceased person's data. NCSA guidance confirms operative 30-day response and appeal windows for at least the right-to-object mechanism. No periodic updates recorded in this cycle Sources and claims (5) - [DataGuidance (mirror of Official Gazette text)](https://www.dataguidance.com/sites/default/files/30802b_965abe73ea2e48899a28a4aefe2d3705.pdf) — Chapter III of the law grants data subjects a right to information (Article 23), which functions as Rwanda's access-right analogue within the omnibus statute. - [DataGuidance (mirror of Official Gazette text)](https://www.dataguidance.com/sites/default/files/30802b_965abe73ea2e48899a28a4aefe2d3705.pdf) — Data subjects hold a right of rectification or erasure under Article 25 of the Data Protection Law. - [OneTrust DataGuidance](https://www.dataguidance.com/news/rwanda-ncsa-publishes-guidance-right-object) — A data subject can object to personal data processing where the processing is likely to cause loss, sadness, or anxiety, or where personal data are processed for direct marketing purposes, including related profiling. - [DataGuidance (mirror of Official Gazette text)](https://www.dataguidance.com/sites/default/files/30802b_965abe73ea2e48899a28a4aefe2d3705.pdf) — The law provides a right to data portability under Article 26 of Chapter III. - [OneTrust DataGuidance](https://www.dataguidance.com/news/rwanda-ncsa-publishes-guidance-right-object) — A data controller or processor must, within 30 days of receipt of an objection request, inform the data subject in writing or electronically of compliance or reasons for non-compliance; a dissatisfied data subject may appeal to the NCSA within 30 days of receiving that response. ### Rwanda: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Security and breach provisions are strongly evidenced (T1); DPIA/DPO/ROPA/joint-controller specifics remain gaps pending fuller primary-text review. Primary framework Law N°058/2021, Chapters IV-V Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Amber Security and breach provisions are strongly evidenced (T1); DPIA/DPO/ROPA/joint-controller specifics remain gaps pending fuller primary-text review. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Rwanda's Law N058/2021 imposes a data-localisation-by-default obligation on controllers and processors: personal data must be stored within Rwanda unless the entity holds a valid registration certificate specifically authorising transfer or storage abroad. This is a confirmed, foundational structural feature of the regime, placing the default compliance posture on domestic storage and requiring an affirmative regulatory authorisation for any departure from it. This localisation-by-default design has direct practical consequences for controllers and processors operating in or serving the Rwandan market: absent the specific registration certificate, standard practice such as using foreign cloud infrastructure or foreign data processors for Rwandan personal data would fall outside the compliant default and would require the entity to first secure the relevant authorisation. This places Rwanda among the more restrictive jurisdictions on data localisation relative to a purely consent-based or adequacy-based cross-border framework. No sourced material this cycle addresses DPIA thresholds or DPO-appointment triggers under Law N058/2021; these remain open evidentiary gaps rather than confirmed absences, and controllers should not assume the absence of sourced material here reflects an absence of such obligations in the underlying statute. #### Outlook The registration-certificate mechanism that gates both localisation exceptions and cross-border transfer (addressed further under cross-border and adequacy) is the central operative lever in this module; watch for any NCSA guidance clarifying the registration-certificate application process or criteria in coming cycles. D4 · Controller & Processor — Full Module Record 7 sub-modules · 44 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Rwanda: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cross-border transfer mechanism is confirmed at T1; adequacy status, SCC/BCR uptake, TIA requirement and precise localisation posture are unconfirmed gaps. Primary framework Law N°058/2021, Articles 53-59 Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Amber Cross-border transfer mechanism is confirmed at T1; adequacy status, SCC/BCR uptake, TIA requirement and precise localisation posture are unconfirmed gaps. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy Under Article 50 of Law N058/2021, any cross-border transfer of personal data out of Rwanda requires a valid registration certificate that specifically authorises that transfer. This is a confirmed core mechanism of Rwanda's cross-border data-transfer regime and functions as the direct counterpart to the data-localisation-by-default posture addressed under controller and processor duties: the same registration-certificate instrument that permits an exception to localisation is the instrument that authorises a cross-border transfer in the first place. No adequacy decisions, whether unilateral findings by Rwanda regarding other jurisdictions or by other jurisdictions regarding Rwanda, have been identified this cycle. This means Rwanda's cross-border regime currently operates on a registration-and-authorisation model rather than an adequacy-list model; every cross-border transfer requires its own specific certification rather than benefiting from a standing determination that a destination jurisdiction offers equivalent protection. This registration-gated approach is a materially more restrictive cross-border framework than an adequacy-based or standard-contractual-clause-based system, and entities transferring Rwandan personal data internationally should treat certificate acquisition as a precondition rather than a formality. #### Outlook Watch for whether Rwanda develops any adequacy-decision mechanism or bilateral/regional data-transfer arrangement in coming cycles, which would represent a structural shift away from the current pure registration-certificate model; no such development has been sourced this cycle. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 58 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Rwanda: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sector-specific overlay evidence located across any of the seven declared sub-modules; treated as an explicit gap rather than silent omission. Traffic-light rationale — Red No sector-specific overlay evidence located across any of the seven declared sub-modules; treated as an explicit gap rather than silent omission. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 35 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Rwanda: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only direct-marketing objection rights are evidenced; the remaining five declared sub-modules carry no located findings, consistent with the seed's 'T2 is thin' caution flag. Primary framework Law N°058/2021, Article 24 Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Red Only direct-marketing objection rights are evidenced; the remaining five declared sub-modules carry no located findings, consistent with the seed's 'T2 is thin' caution flag. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 32 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Rwanda: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ ADM protection is confirmed at T1; the remaining four sub-modules are unconfirmed gaps. Primary framework Law N°058/2021, Article 27 Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Amber ADM protection is confirmed at T1; the remaining four sub-modules are unconfirmed gaps. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 38 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Rwanda: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Existence of a child's-consent mechanism is confirmed at T1 (final law TOC); the precise age threshold rests on an uncorroborated draft-instrument citation, and dependent-adults/education-specific rules are unconfirmed gaps. Primary framework Law N°058/2021, Article 10 Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Amber Existence of a child's-consent mechanism is confirmed at T1 (final law TOC); the precise age threshold rests on an uncorroborated draft-instrument citation, and dependent-adults/education-specific rules are unconfirmed gaps. D9 · Children's Privacy — Full Module Record 5 sub-modules · 60 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Rwanda: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Regulator powers and penalty framework are strongly evidenced at T1; enforcement-activity case data and regulator funding/capacity signals are unconfirmed gaps. Primary framework Law N°058/2021, Chapter IX (Articles 64-72) Supervisory authority [National Cyber Security Authority (NCSA) - Data Protection and Privacy Office](https://www.ncsa.gov.rw/) Traffic-light rationale — Amber Regulator powers and penalty framework are strongly evidenced at T1; enforcement-activity case data and regulator funding/capacity signals are unconfirmed gaps. Periodic update · new data 2026-10-25 #### Enforcement & Redress Rwanda's National Cyber Security Authority maintained an active enforcement posture through this cycle without, however, publishing an individual enforcement decision against a named controller or processor. The clearest evidence of this posture is the NCSA's 2026 Data Privacy Week, held 26 to 30 January 2026 under the theme "Compliance is Beyond Registration, it's a Continuous Journey." The framing is notable: it positions obtaining a Data Protection and Privacy certificate as only the starting point of compliance, implying that the regulator expects controllers and processors to maintain ongoing conformity with their obligations rather than treating registration as a one-time administrative step. The underlying penalty structure for registration failure is understood, from a secondary source, to be an administrative fine of between RWF 2 million and 5 million, or alternatively one percent of the controller's or processor's prior-year global turnover. A separate secondary source describes a different-looking penalty structure attaching to Law N°058/2021 more broadly: a maximum administrative fine of one percent of global turnover of the preceding financial year, and a maximum criminal fine of five percent of annual turnover of the previous financial year. It is not established in the sourcing available whether these are two descriptions of the same provision, with the RWF figures serving as a floor beneath the turnover-based ceiling, or whether they are genuinely separate penalty provisions applicable to different categories of breach. This is recorded as an open reconciliation question rather than resolved either way. No published decision applying either penalty structure to a named entity was located. The absence of such a decision, set against the sustained public messaging of the Data Privacy Week campaign and continuing registration-enforcement commentary through September 2026, suggests a regulator exercising visible supervisory pressure through awareness and registration channels, while any escalation to individual sanction, if it has occurred, has not been documented in sources available to this research. #### Outlook What would clarify the picture is either a published NCSA enforcement decision naming a specific controller or processor, which would resolve how the two differently stated penalty figures actually interact in practice, or a primary-source retrieval of Law N°058/2021's penalty articles directly from the gazette. Until then, the registration-fine figures and the broader turnover-based penalty figures should be read as potentially overlapping rather than confirmed as either identical or distinct. Periodic update · new data 2026-10-11 #### Enforcement & Redress Rwanda's National Cyber Security Authority maintained an active enforcement posture through this cycle without, however, publishing an individual enforcement decision against a named controller or processor. The clearest evidence of this posture is the NCSA's 2026 Data Privacy Week, held 26 to 30 January 2026 under the theme "Compliance is Beyond Registration, it's a Continuous Journey." The framing is notable: it positions obtaining a Data Protection and Privacy certificate as only the starting point of compliance, implying that the regulator expects controllers and processors to maintain ongoing conformity with their obligations rather than treating registration as a one-time administrative step. The underlying penalty structure for registration failure is understood, from a secondary source, to be an administrative fine of between RWF 2 million and 5 million, or alternatively one percent of the controller's or processor's prior-year global turnover. A separate secondary source describes a different-looking penalty structure attaching to Law N°058/2021 more broadly: a maximum administrative fine of one percent of global turnover of the preceding financial year, and a maximum criminal fine of five percent of annual turnover of the previous financial year. It is not established in the sourcing available this cycle whether these are two descriptions of the same provision, with the RWF figures serving as a floor beneath the turnover-based ceiling, or whether they are genuinely separate penalty provisions applicable to different categories of breach. This is recorded as an open reconciliation question rather than resolved either way. No published decision applying either penalty structure to a named entity was located this cycle. The absence of such a decision, set against the sustained public messaging of the Data Privacy Week campaign and continuing registration-enforcement commentary through September 2026, suggests a regulator exercising visible supervisory pressure through awareness and registration channels, while any escalation to individual sanction, if it has occurred, has not been documented in sources available to this research. #### Outlook What would clarify the picture is either a published NCSA enforcement decision naming a specific controller or processor, which would resolve how the two differently stated penalty figures actually interact in practice, or a primary-source retrieval of Law N°058/2021's penalty articles directly from the gazette. Until then, the registration-fine figures and the broader turnover-based penalty figures should be read as potentially overlapping rather than confirmed as either identical or distinct. Periodic update · new data 2026-09-28 #### Enforcement & Redress Rwanda's National Cyber Security Authority, through its Data Protection Office, ran a five-day ISO 31000 risk-management training programme for data protection officers between 27 and 31 July 2026. This is a confirmed, recent regulator activity and signals an operationally active regulator that is investing in building compliance capability within the DPO community, rather than an enforcement posture limited purely to reactive penalty action. The standing penalty framework for unregistered operation remains a structural feature of the enforcement regime: operating without a data-protection-and-privacy certificate carries a fine of RWF 2 to 5 million or 1% of the entity's prior-year revenue, and false registration submissions carry custodial penalties in addition to the financial fine. The revenue-percentage component of this fine structure means the practical deterrent scales with entity size, giving the NCSA meaningful leverage against larger organisations for whom a fixed penalty alone might be an insufficient deterrent. No documented NCSA enforcement decisions for 2025 to 2026 have been identified this cycle. This is a genuine evidentiary gap rather than a finding that no enforcement has occurred; the standing penalty framework and the capacity-building training both indicate an active regulator, but a specific enforcement decision applying the RWF 2-5 million or 1% revenue fine has not been sourced. #### Outlook The key marker to watch is whether a first documented NCSA enforcement decision under the standing penalty framework surfaces in coming cycles, which would move this module from structural-framework description to observed enforcement practice. Periodic update · new data 2026-08-26 #### Enforcement & Redress Rwanda's National Cyber Security Authority holds defined administrative-sanction powers under Article 28 of Law N°058/2021. Individuals, organisations, data controllers, or data processors that operate without a Data Protection and Privacy certificate may be fined between RWF 2 million and RWF 5 million, or an amount equal to 1 percent of the entity's total revenue from the previous fiscal year, depending on which framework applies to the case. This penalty structure is reported with confidence, though it is understood to rest on a single tier-3 secondary account of the statute's penalty bands rather than on independently verified statute text, and should be read with that qualification in mind. Separately, Rwanda's Data Protection and Privacy Office undertook two documented capacity-building activities in July 2026: a five-day ISO 31000 risk-management training for data protection officers, held 27 to 31 July, and a study visit hosting a foreign data protection commissioner's office, held 15 to 17 July. These are confirmed institutional developments, sourced directly to the DPO's own primary web presence, and represent supervisory-capacity investment rather than a change to the statutory penalty regime itself. #### Outlook The principal open question is whether NCSA's Article 28 penalty bands will be tested against an actual enforcement action in a future cycle, which would allow independent verification of the penalty structure beyond the tier-3 secondary sourcing relied on this cycle. Whether the July capacity-building activity, in particular the ISO 31000 training, translates into a documented change in NCSA's supervisory or investigative practice is a second item to track going forward. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 84 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action