The Data Protection Law provides for administrative misconduct sanctioned by administrative fines (article 53) and offences sanctioned by imprisonment and fines (article 56 to 63). 

The administrative fines related to administrative misconduct imposed by the NCSA include operating without a registration certificate, failure to designate a personal data officer, failure to respect obligations related to personal data breach (notification, report, and communication) (article 53). The administrative fine is between RWF 2,000,000 to RWF 5,000,000 or 1% of the global turnover of the preceding financial year for corporate body or legal entity. 

Any person not satisfied with the administrative sanction taken against them has the right to file an application to the competent court (article 54). 

The NCSA is the initial organ in charge of settlement of conflicts arising in relation to the Data Protection Law. 

The Data Protection Law provides that the following violations are considered criminal offences (article 56 to 61): 

• access, collection, use, offer, share, transfer or disclosure of personal data contrary to the Data Protection Law;
• re-identification of de-identified personal data contrary to the Data Protection Law;
• destruction, erasure, concealment or alteration of personal data contrary to the Data Law Protection Law;
• sale of personal data contrary to the Data Protection Law;
• collection or process of sensitive personal data contrary to the Data Protection Law;
• provision of false information. 

Corporate body or legal entity convicted of committing offence(s) is liable to a fine amounting to 5% of the annual turnover of the previous financial year (article 62). 

Additional penalties for the offences that the court can order include (article 63):

• seizure or confiscation of items used in the commission of any of the offences;
• permanent or temporary closure of the legal entity or body or the premises in which any of the offences were committed.