Cybersecurity law & regulation in Rwanda (2026)

Legal framework

Law No. 26/2017 (NCSA Establishment), Law No. 60/2018 (Prevention and Punishment of Cyber Crimes), Law No. 058/2021 (Personal Data and Privacy Protection), RURA Cybersecurity Regulation No. 010, and National Cybersecurity Strategy 2024-2029, administered by the National Cyber Security Authority (NCSA)

Key points: cybersecurity in Rwanda

1. 01NCSA as apex authority

   Law No. 26/2017 established the National Cyber Security Authority with administrative and financial autonomy to advise the President, protect critical information infrastructure (CII), and operate Rwanda's CSIRT (Rw-CSIRT). Critical information infrastructure operators are designated by Presidential Order.

   bwcimplementation.org cyber.gov.rw

2. 02Cybercrime law (2018)

   Law No. 60/2018 criminalises unauthorised system access, data interception, and related offences. Electronic communications service providers must immediately report cyber incidents to NCSA; failure to report is itself a criminal offence carrying imprisonment and fines. A new cybercrime law was adopted by Rwanda's Chamber of Deputies in January 2025, updating these provisions.

   policyvault.africa minict.gov.rw

3. 03Breach notification (48-hour rule)

   Under Law No. 058/2021 on Personal Data Protection and Privacy, data controllers must notify the Data Protection and Privacy Office within 48 hours of becoming aware of a personal data breach; data processors must notify the controller within 48 hours. Where the breach poses high risk to data subjects, written or electronic notification to affected individuals is also required. Non-compliance attracts fines of RWF 2-5 million or 1% of global turnover.

   dlapiperdataprotection.com dpo.gov.rw

4. 04RURA sector regulation

   The Rwanda Utilities Regulatory Authority issued Cybersecurity Regulation No. 010/R/CR-CSI imposing cybersecurity obligations on regulated ICT and telecommunications operators. RURA has historically enforced compliance, including a RWF 7.03 billion fine against MTN Rwanda in 2017 for hosting IT services outside the country.

   rura.rw rura.rw

5. 05Minimum cybersecurity standards (2023)

   NCSA released sector-specific minimum cybersecurity standards in 2023 for public institutions, the financial sector, and essential service providers, operationalising security-by-design and risk management requirements across critical sectors.

   cyber.gov.rw cyber.gov.rw

6. 06National Cybersecurity Strategy 2024-2029

   Launched in August 2024, Rwanda's five-year strategy sets seven pillars: governance, CII protection, risk management, capacity building, international cooperation, cybercrime combat, and cybersecurity culture. Rwanda has also acceded to the Budapest Convention on Cybercrime.

   cyber.gov.rw jsis.washington.edu

Sources

1. 1.cyber.gov.rw/home/
2. 2.cyber.gov.rw/documentation/
3. 3.bwcimplementation.org/sites/default/files/resource/Law%20establishing%20the%20National%20Cy
4. 4.policyvault.africa/policy/law-on-prevention-and-punishment-of-cyber-crimes/
5. 5.minict.gov.rw/news-detail/mps-adopt-cyber-crime-law
6. 6.rura.rw/fileadmin/Documents/ICT/Laws/Cybersecurity_Regulation_in_Rwanda.pdf
7. 7.dlapiperdataprotection.com/index.html?t=breach-notification&c=RW
8. 8.dpo.gov.rw/fileadmin/DPO/ComplianceTools/Personal%20Data%20Breach%20Notification
9. 9.cyber.gov.rw/updates/article/ncsa-releases-minimum-cybersecurity-standards/
10. 10.cyber.gov.rw/index.php?eID=dumpFile&t=f&f=427&token=6375c4cab9b091a9747cd9f07f8dc6
11. 11.jsis.washington.edu/news/cybersecurity-profile-2025-rwanda/
12. 12.cyber.gov.rw/about/
13. 13.rura.rw/sectors/ict/overview