Rwanda's data protection law says personal data must be stored in Rwanda, and storing it abroad needs a certificate from the supervisory authority. Any European buyer planning to run Rwandan customer data through a European cloud should read Article 50 of Law No. 058/2021 before talking price.
That clause is the sharpest edge in a country whose record reads as a sequence of deliberate, dated moves. The sections below follow them in order.
Key takeaways
- Law No. 058/2021 (Official Gazette special, 15 October 2021) sets a 48-hour breach notice, a default of storing data in Rwanda and authorisation rules for transfers out.
- The market is small: the August 2026 labour force survey counts about 5.6 million people in the labour force and an unemployment rate of 15.6%.
- Connectivity looks strong on paper (14.5 million active SIMs, June 2026) but fixed broadband is thin at 84,152 active subscriptions.
- Kigali Innovation City is a plan with projections, not a finished campus.
- Our reading: use Rwanda for governed pilots, fintech and health or government-adjacent work, not for volume BPO.
2015: Irembo shows what the state buys locally
Irembo, the government services portal, launched in 2015. A World Bank blog (undated, so its numbers are old) described more than 40 online services, over 100,000 applicants a month, and an operator, RwandaOnline, working under a 25-year build-operate-transfer concession at roughly US$1 per transaction. About 45% of transactions came from phones.
Why this matters for a buyer: it is a template. The state signed a long concession with a local operator and let it earn per transaction. Expect public-sector procurement in Rwanda to favour operators that carry long-term delivery risk, and expect a European supplier without a local entity to struggle in that market.
October 2021: the data law
Law No. 058/2021 of 13 October 2021, published in the Official Gazette special of 15 October 2021, is the document to read in full. The provisions that bite on a European buyer:
- Article 43. After becoming aware of a breach, the controller must inform the supervisory authority within 48 hours.
- Article 44. A written report with all available facts follows within 72 hours.
- Article 45. Where there is a likely high risk to the person, the controller informs that person.
- Article 48. Transfers or sharing outside Rwanda are allowed if the authority has given authorisation after proof of safeguards, if the data subject has consented, or if the transfer is necessary on listed grounds such as contract performance, public interest or a legal claim.
- Article 50. Personal data is stored in Rwanda. Storage outside Rwanda is permitted only with a valid registration certificate authorising it, issued by the authority.
- Article 53. Administrative misconducts include operating without a registration certificate and failing to designate a data protection officer.
DLA Piper's summary adds that the National Cyber Security Authority supervises the law and that administrative fines for corporate bodies run from RWF 2 million to RWF 5 million or 1% of prior-year global turnover. We read the statute text itself for the article contents above; we have not verified the fine amounts in it, and IAPP reports higher figures, so treat the range as unsettled and check the Official Gazette. DLA Piper also numbers the breach articles slightly differently from the gazette, and where they differ we followed the gazette.
On the working side, the Data Protection Office site lists services for controller and processor certificates, for authorisation to transfer data out and to store it abroad, and posts standard contractual clauses and a self-assessment form. The clauses were adopted on 1 February 2024, according to the Digital Policy Alert tracker. We did not find published processing times, so ask your supplier how long their last certificate took.
This is general information, not legal advice.
2023 to 2024: AI policy, and a campus with a cloud of projections
The Ministry of ICT and Innovation and the regulator RURA developed a National AI Policy, which its ministry page describes as six policy areas with 14 recommendations. The page gives no approval date, and a UNDP policy brief places it in 2023. That brief, published on UNDP's site in 2026, is more candid than most government material: it names "a limited pool of advanced AI talent, fragmented data systems, high compute costs, and financing gaps for deep-tech ventures" as the key constraints. Read that as the honest ceiling for AI services from Rwanda today.
On 31 May 2024 the government, the Rwanda Development Board and Africa50 signed an implementation agreement for Kigali Innovation City on a 61-hectare site. The release projects about US$150 million in annual ICT exports and more than 50,000 jobs on completion, and names Carnegie Mellon University Africa, African Leadership University, AIMS and a University of Rwanda centre as anchors. Those are projections from the developer's own release. We found no source confirming how much of the city exists, so do not count on it when planning a 2027 team.
The incentive on offer for registered ICT firms, per RDB's page, is a 15% corporate income tax rate, with residence permits and hiring of foreign staff without standard labour market tests. The page lists BPO only as an opportunity and gives no figures.
2026: what the numbers say now
The telecom regulator's second-quarter 2026 report, based on operator returns, gives these observed figures for 30 June 2026:
| Indicator | Value | |---|---| | Active mobile subscriptions | 14,501,766 (100.6 per 100 inhabitants) | | Market share, MTN / Airtel | 65.8% / 34.2% | | SIMs linked to active mobile money | 8,908,398 (61.8 per 100) | | Mobile internet subscriptions | 11,109,432, of which 4G 6,313,338 | | Active fixed broadband | 84,152 (down 2.3% as inactive lines were removed) | | Equipped international bandwidth | 1,197 Gbps (from 755 Gbps a year earlier) |
Subscriptions are SIM cards, not people, and a rate above 100 per 100 inhabitants reflects multiple SIMs. Two operators control the whole mobile market, so a single-network outage matters more than it would in a larger market. The thin fixed line count means your supplier's office connection, rather than national mobile coverage, is what you need to inspect.
The statistics office tells a more cautious story about labour. Its August 2026 labour force survey reports unemployment of 15.6%, up from 13.4% in August 2025, with youth (ages 16 to 30) at 18.8% and a labour underutilisation rate of 61.8%. The labour force is 5.6 million. Unemployment of this size suggests there are candidates for entry-level roles, but the survey does not break down skills, and the UNDP brief says advanced talent is scarce. September 2026 inflation was 17.2% year on year, per the same office's home page, which matters if any of your costs are in francs.
We could not read a National Bank of Rwanda statement, so we have no verified exchange-rate commentary. Price in euros and write the rate-risk allocation into the contract.
Language and clocks
The government site lists Kinyarwanda alongside English, French and Kiswahili as official languages and gives the time zone as UTC+2. It does not say which languages are used in business or education, so test language skills per team. By our arithmetic, UTC+2 matches Central European Summer Time and sits an hour ahead of Central European winter time; confirm against your own calendar.
Our reading and the best counterargument
Rwanda earns a place on a shortlist when the buyer values rule clarity, a recent data statute and a government that treats digital delivery as policy. It is a weak choice when you need hundreds of seats, deep AI engineering or a loose data transfer regime.
The strongest counterargument is that small markets can still make strong export suppliers if the state coordinates talent, and Kigali Innovation City plus university partnerships could do that. The evidence so far is projections and a policy brief naming shortages.
Buyer guidance
Check
- Whether the supplier holds a registration certificate and, if you want data stored outside Rwanda, the specific certificate authorising it.
- Their breach runbook against the 48-hour and 72-hour steps in Articles 43 and 44.
- Their network: two independent connections at the office, not only mobile coverage.
Ask
- Which standard contractual clauses they use for any transfer abroad and how long the authority took to approve.
- Team size, tenure and the share of staff with advanced technical training, not headline headcount.
- Whether any work depends on Kigali Innovation City infrastructure, which may not yet exist.
Decide
- Whether data can stay in Rwanda (simplest) or needs an authorised transfer.
- A pilot of one product team, with a review at six months, before any scale commitment.
- Euro pricing, with a clear owner of exchange-rate and inflation risk.
The Rwanda country page and the partner search are a starting point for a long list, and the intelligence section shows cross-country comparisons. Verify each shortlisted company's registration directly.
Frequently asked questions
Does Rwanda require data to stay in the country? Article 50 says personal data is stored in Rwanda, and storing it abroad needs a valid registration certificate authorising it from the supervisory authority.
How fast must breaches be reported? The controller must notify the authority within 48 hours of becoming aware (Article 43) and file a report within 72 hours (Article 44).
Is Rwanda a good BPO destination? The official sources we read give no BPO volume data, the labour force is about 5.6 million, and RDB lists BPO only as an opportunity. It suits pilots and specialist teams better than large operations.
Is Kigali Innovation City open? The 2024 agreement describes a project to be built. We found no confirmation of completion, so check with the supplier.
Sources
- Law No. 058/2021, Official Gazette special of 15/10/2021, NCSA.
- Data Protection Office, Rwanda.
- ICT Sector Statistics Report, Q2 2026, RURA.
- Labour Force Survey 2026 Q3, NISR, 20 October 2026.
- Kigali Innovation City agreement, Africa50, 6 June 2024.
- UNDP policy brief on AI and innovation, UNDP.
- Irembo case, World Bank blog.
- ICT investment opportunities, RDB.
- National AI Policy, MINICT.
- Standard contractual clauses entry, Digital Policy Alert.
- About Rwanda, Government of Rwanda.
- Rwanda data protection summary, DLA Piper, last modified 6 January 2025.
This guide is general information, not legal, tax or financial advice.