Rwanda's NCSA Presses Data-Controller Registration as Enforcement Sharpens
Rwanda's data authority continues to enforce mandatory registration for controllers and processors, with fines up to RWF 5 million or 1 percent of turnover for operating without a DPP certificate.
What Changed
Through 2026, Rwanda's Data Protection and Privacy Office (DPO), operating under the National Cyber Security Authority (NCSA), has continued active enforcement of mandatory registration under Law No. 058/2021 relating to the protection of personal data and privacy. Every data controller and data processor must register and obtain a data protection and privacy (DPP) certificate, which the NCSA issues within 30 working days of application; there is no registration fee. The two-year transition period ended on 15 October 2023, so registration is now a live obligation rather than a grace-period expectation. Operating without a DPP certificate can attract an administrative fine of RWF 2 million to RWF 5 million, or one percent of the prior year's global turnover.
Who It Affects
Organisations established in Rwanda and foreign entities processing the personal data of Rwandan residents, spanning banks, fintechs, telcos, healthcare providers, and any body determining or carrying out data processing. Both controllers and processors must register in their own right. With the transition period long expired and awareness campaigns giving way to enforcement, the absence of a DPP certificate is no longer a paperwork gap but a fineable breach measured against turnover.
What to Do
Confirm whether your organisation is registered as a controller, a processor, or both, and submit any outstanding NCSA applications now, allowing for the 30-working-day issuance window before a DPP certificate is granted. Appoint a data protection officer where required, map processing activities, and document lawful bases, retention, and cross-border transfers. Ensure identity-verification and personal-data flows capture consent and produce auditable records, so registration is backed by demonstrable compliance rather than a certificate alone.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds.
Learn More