The DC is required to only collect personal data for a lawful purpose connected to its the activity and when the data is necessary for that purpose (article 42). 

When collecting personal data, the DC is required to inform the data subject of the following: 

• identity and contact details;
• purposes for which personal data are collected;
• recipients of such personal data;
• whether the data subject had the right to provide personal data voluntarily or mandatorily;
• the existence of the right to withdraw consent at any time and that such withdrawal does not affect the lawfulness of the processing of personal data based on consent before its withdrawal;
• the existence of the right to request from the DC access and ratification, restriction or erasure of personal data concerning the data subject or to object to the processing of the data;
• the existence of automated decision-making including profiling, and information about the logic involved, as well as the significance and the envisaged consequences of such processing personal data for the data subject;
• the period for which personal data will be stored;
• the right to appeal to the supervisory authority;
• where applicable, that the DC can transfer personal data outside of Rwanda and assures the data subject of the personal data security;
• any further information likely to guarantee fair processing of the personal data, having regard to the specific circumstances in which the data are collected. 

The DC is not subject to the above disclosure requirements if: 

• the data subject already has the information;
• the provision of such information proves impossible or involves a disproportionate effort; or
• the recording or disclosure of the personal data is required by the Data Protection Law. 

The DC or DP must handle personal data for lawful purposes which include the following (article 46): 

• the data subject’s consent to process their personal data for purpose explained to them;
• processing is necessary:
  • for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  • for the execution a legal obligation to which the DC is subject;
  • for the protection of vital interests of the data subject or any other person;
  • for the performance of a duty carried out in the public interests or in the exercise of official authority vested in the DC;
  • for the performance of duties of a public entity;
• the processing is intended for legitimate interests pursued by the DC or by a third party to whom the personal data are disclosed, unless the processing is unwarranted in any particular case having regard to the prejudice to the rights and freedoms or legitimate interests pursued by the data subject;
• the processing is carried out for research purposes upon authorization by relevant institution. 

The Data Protection Law also provides for requirements relating to the processing of personal data of a child under the age of 16 years which include the following (article 9): 

• processing of the child’s personal data is subject to obtaining the consent of the holder of parental responsibility over the child;
• the consent obtained on behalf of the child must be given in the child’s interest to be acceptable;
• the consent is not required if it is necessary for protecting the vital interest of the child. 

The DC or DP must store personal data in Rwanda. Storage of personal data outside of Rwanda is only permitted if the DC or DP holds a valid registration certificate authorising them to transfer or store personal data outside Rwanda (article 50).