Managing Personal Data in Rwanda: Risks, Rights, and Responsibilities.

Ishimwe Sibomana Christian 

University of Rwanda, College of business and economics, Kigali, Rwanda

Abstract

As Rwanda expands its digital infrastructure, personal data has become central to public services, business operations, and everyday life. This study examines how personal data is managed in Rwanda by focusing on the risks individuals face, the rights provided under the law, and the responsibilities placed on institutions that collect and process information. Using qualitative analysis of policy and institutional practices, the article highlights key challenges such as data misuse, cybersecurity threats, and limited public awareness of legal protections. While Rwanda has adopted a regulatory framework for data protection, enforcement remains uneven across different  sectors. The paper argues that meaningful data governance requires not only legal structures but also institutional accountability and citizen awareness to build trust in digital systems and safeguard individual privacy.

Keywords

Personal data; Data governance; Data privacy; Digital identity; Cybersecurity; Regulatory frameworks; Digital rights; Data protection law; Consent management; E-government systems; Information security; Institutional accountability; Digital literacy; Rwanda

  I .Introduction 

In recent years, Rwanda has undergone a dramatic digital transformation, making personal data increasingly central to everyday life, governance, commerce, and public services. As of mid-2025, the country counted around 5.5 million active internet users, driven by expanded infrastructure, mobile subscriptions, and supportive digital policies. Mobile-cellular subscriptions now exceed 13 million, indicating widespread mobile connectivity across urban and rural areas. This proliferation of digital access  including growth in online services, mobile banking,  e-government platforms and social media   has resulted in the generation and collection of vast amounts of personal data: identity information, location data, financial and health records, and usage metadata, among others.

However, this rapid digital uptake exposes serious vulnerabilities in data governance and privacy protection. Although national authorities have recently approved a comprehensive (National Data Sharing Policy ,May 2025) to regulate inter-institutional data sharing and ensure lawful, secure, and efficient exchange of information across public institutions, some implementation gaps and ambiguities remain. Meanwhile, the disparity in internet access   with urban users outpacing rural populations in both connectivity and digital literacy  risks excluding a significant portion of the population from the protections and benefits of data governance frameworks. 

Against this backdrop, questions about who owns, controls, and safeguards personal data in Rwanda become urgent and complex. Ownership of data is no longer a theoretical concern: it has real implications for privacy, civil rights, equitable access to digital services, identity security, and trust in institutions. As digital adoption deepens, safeguarding personal data  from collection and storage to sharing and deletion must be treated as a core element of national development strategy.

This article seeks to map the contemporary landscape of personal data management in Rwanda by examining the risks individuals face, the rights granted by evolving legal and institutional frameworks, and the responsibilities imposed on data-handling entities. In doing so, it aims to illuminate the gap between digital potential and governance capacity, and to propose actionable pathways to ensure that Rwanda’s digital transformation advances in a secure, transparent, and inclusive manner.

II. FINDINGS 

“The right to privacy is not a luxury in the digital age but a necessity for democratic governance and sustainable development.” — United Nations, 2018

Rwanda’s rapid digitalisation is reshaping how personal data is generated, shared and stored across both public and private institutions. As of 2024, the country records approximately 5.5 million internet users, representing nearly 38% of the population, while mobile subscriptions exceed 13 million, suggesting that many individuals own multiple SIM cards (Data Reportal, 2024). This disparity between internet usage and mobile access indicates that a significant proportion of personal data is generated through telecommunications services rather than online platforms alone. Such expansion has intensified the collection of personal information through mobile financial services, e-government platforms, and biometric systems. While this growth supports efficiency and financial inclusion, it also multiplies the amount of sensitive personal data exposed to institutional misuse, cybercrime, and unlawful sharing (ITU, 2023; World Bank, 2022).

Despite the legal protection provided by Law No. 058/2021 on the Protection of Personal Data and Privacy, evidence suggests that compliance among data controllers remains inconsistent. Rwanda officially adopted a National Data Sharing Policy in May 2025, enabling cross-institutional data exchange in public services (MINICT, 2025). However, the operational gap between policy and practice is visible across sectors such as healthcare, banking, and education where data governance structures are underdeveloped (DPO Rwanda, 2024). Institutional audits indicate that many organisations collect data without clearly defining storage duration, access control, or breach response mechanisms (RDB, 2023). These weaknesses compromise both accountability and individual rights, particularly in institutions that process large volumes of citizen information daily.

Rwanda is increasingly affected by cybercrime, particularly identity theft and digital fraud. A regional consumer survey by TransUnion 2024 found that 54% of respondents in East Africa reported being targeted by fraudsters via email, SMS, or phone calls, showing Rwanda is not immune to digital exploitation. The National Cyber Security Authority (NCSA) further reports a growing number of cybersecurity incidents affecting banks and government portals between 2022 and 2024. These risks are compounded by limited cyber awareness among users and the absence of strong institutional breach disclosure policies (NCSA, 2024; INTERPOL, 2023). Without adequate safeguards, personal data becomes a vulnerability rather than an asset in the digital economy.

The management of identity data represents one of the most critical privacy challenges in Rwanda. While over 6.6 million citizens were already registered under the traditional national ID system, the rollout of the new biometric Digital ID (e-ID) system enrolled only about 300,000 individuals by late 2025 (NIDA, 2025). This imbalance concentrates sensitive biometric data within a small infrastructure undergoing rapid deployment, raising concerns about storage security, misuse, and long-term integrity of records (World Economic Forum, 2023). Although the government has trained over 250 Data Protection Officers in recent years, the speed of identity digitisation exceeds the capacity for oversight and risk management (DPO Rwanda, 2024). Thus, while digital ID promises efficiency, its governance framework must mature just as fast to prevent systemic abuse.

III. COMPARISONS OF THE PARADOX

Rwanda presents a unique paradox in its management of personal data: it ranks among Africa’s most ambitious digital reformers, yet remains institutionally constrained in data protection enforcement. On one hand, the government has introduced advanced digital platforms such as Irembo , national biometric ID systems, and cashless payment services. On the other hand, regulatory oversight mechanisms operate with limited visibility and technical capacity when compared to advanced data economies such as Estonia, Singapore, or the United Kingdom (World Economic Forum, 2023). While these countries maintain independent supervisory authorities with strong penalties for violations, Rwanda’s framework remains largely corrective rather than punitive. This contrast highlights a significant gap between digital ambition and enforcement maturity, where progress in infrastructure is not yet matched by equal progress in institutional accountability.

Another contradiction lies in the relationship between data collection efficiency and privacy protection. Rwanda has successfully digitized public service delivery through centralized data systems, increasing speed and reducing corruption (World Bank, 2022). However, efficiency has come at the cost of weak consent practices. In many sectors, individuals are required to submit personal data as a condition for accessing education, credit, or healthcare, often without full understanding of how their information will be used or stored (OECD, 2021). In contrast, in the European Union, the General Data Protection Regulation (GDPR) enforces principles such as consent, purpose limitation, and data minimization, allowing individuals to refuse non-essential data collection without losing access to services. Rwanda, by comparison, remains operationally centralized but procedurally underdeveloped in citizen control over personal information.

A further paradox exists between public trust and institutional transparency. Despite high citizen confidence in government systems, transparency regarding data breaches, algorithmic decision-making, and information sharing remains minimal (Afrobarometer, 2023). In highly digitised countries such as Germany and Canada, data breach notifications are legally mandatory and publicly disclosed. In Rwanda, however, no publicly accessible breach registry exists, and institutional self-reporting remains rare. This imbalance creates what scholars refer to as “silent vulnerability” — where citizens trust silent systems that may not yet be fully secured (Zuboff, 2019). Trust, in this context, is not a result of demonstrated accountability but rather the absence of visible failure.

Finally, Rwanda faces the contradiction of digital inclusion without digital literacy. While smartphone penetration continues to rise, digital rights awareness remains low. Studies in East Africa suggest that fewer than 40% of users understand how their data is collected, stored, or monetized (GSMA, 2023). In contrast, countries such as Finland and South Korea integrate data literacy into national education curricula, creating digitally aware populations capable of exercising informed consent and challenging misuse (UNESCO, 2022). Rwanda’s development model emphasizes access to technology but underinvests in educating users about its risks. This imbalance risks converting citizens from digital beneficiaries into passive data sources in a system they do not fully understand.

In summary, Rwanda’s data governance environment reflects a development paradox: modern systems operating through immature safeguards, widespread trust coexisting with weak transparency, and digital expansion advancing faster than legal enforcement. Resolving this paradox does not require slowing down digitalisation , but rather strengthening the ethical and legal foundation upon which it is built.

IV. CONCLUSION

The management of personal data in Rwanda stands at a critical crossroads between opportunity and vulnerability. As the country advances toward a digital-driven economy, personal data has become a strategic asset shaping governance, financial systems, and service delivery. Yet, this same progress exposes individuals to new risks where privacy, consent, and security are not always guaranteed by practice, despite existing legal provisions. Rwanda’s regulatory frameworks reflect political commitment, but institutional readiness, enforcement capacity, and citizen awareness have yet to mature at the same pace as technological expansion.

The findings reveal that digital transformation without equally strong safeguards risks producing efficiency without protection. Centralized databases, biometric identification systems, and e-government services have improved access and transparency, yet they also concentrate sensitive information in systems that remain susceptible to misuse, cyber threats, and weak accountability. Without mandatory breach reporting, independent oversight, and enforceable penalties, legal protections risk remaining symbolic rather than operational.

Equally important is the role of individuals in data governance. The right to privacy is meaningful only when citizens understand it and can exercise it. However, limited digital literacy constrains users from questioning institutional data practices or safeguarding their own information. As a result, personal data governance in Rwanda remains institution-centric rather than rights-driven.

To secure a trustworthy digital future, Rwanda must harmonize innovation with accountability. This requires strengthening enforcement institutions, integrating data literacy into education, and institutionalizing transparency in public and private data systems. If personal data is to serve national development rather than undermine individual freedom, it must be managed not merely as a technological resource but as a constitutional right. Rwanda’s success in the digital age will therefore not be measured solely by adoption rates, but by how well it protects the citizens behind the data.

Acknowledgement 

Thanks are due to all the people who helped me to make this happen .

References 

• Law Nº 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy. Official Gazette, Republic of Rwanda. Rwandalii+1
• 
  
• Ministry of ICT and Innovation (Rwanda). “Rwanda passes new law protecting personal data.” Government press release. Minict+2Rwanda Institute of Statistics+2
• 
  
• Data Reportal. Digital 2024: Rwanda. Global Digital Insights, 2024. DataReportal – Global Digital Insights+1
• 
  
• AllAfrica.com. “Rwanda’s Internet Users Surge to 5.5 Million Amid Digital Expansion.” 9 June 2025. allAfrica.com+2Aispruce News+2
• 
  
• Data Finance (as reported by AllAfrica). “Rwanda Reaches 38% Internet Penetration but Faces Cost Hurdles.” June 2025. allAfrica.com+1
• 
  
• Rwanda Utilities Regulatory Authority (RURA). ICT Sector Statistics Report, 2024 (mobile and internet subscriptions). RURA+1
•