Compliance FrameworksMiddle East & Africa
Rwanda Law No. 058/2021 on Protection of Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | RW PDPL |
| Region | Middle East & Africa |
| Country or scope | Rwanda |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers RW PDPL
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
RW-PDP-SEC Security of Processing | Controllers and processors must adopt appropriate technical and organisational security measures for personal data, evidenced by integrity hashes on the components of processing systems (Law No. 058/2021, security-of-processing obligations) | Scan |
RW-PDP-BRN48 48-Hour Breach Notification Readiness | Personal data breaches must be notified to the supervisory authority within 48 hours, an aggressive deadline that requires components to be immediately identifiable via PURL or CPE (Law No. 058/2021, breach-notification provisions) | Scan |
RW-PDP-REG Registration and Records of Processing | Controllers and processors must register with the NCSA and maintain records of processing activities, which presupposes an inventory of the software performing that processing (Law No. 058/2021, registration and record-keeping duties) | Scan |
RW-PDP-PROC Processor Guarantees | Controllers may only engage processors offering sufficient security guarantees under contract, so third-party software components must carry named suppliers (Law No. 058/2021, controller-processor provisions) | Scan |
RW-PDP-VER Known Software Versions | Assessing breach impact and keeping processing systems secure over time requires the exact versions of software components to be recorded (Law No. 058/2021, security and breach-assessment duties) | Scan |
Policy templates
All 22 from the standard set, adapted to RW PDPL.