The transfer of personal data outside of Rwanda is only permitted for the following cases (article 48): 

• the DC or DP has obtained authorization from the NCSA after providing proof of appropriate safeguards with respect to the protection of personal data;
• the data subject has given his or her consent;
• the transfer is necessary:
  • for the performance of a contract between the data subject and the DC or the implementation of a pre-contractual measures taken in response to the data subject’s request;
  • for the performance of a contract concluded in the interest of the data subject between the DC and a third party;
  • for public interest grounds;
  • for the establishment, exercise, or defense of a legal claim;
  • to protect the vital interests of the data subject or another person where the data subject is physically or legally incapable of giving his or her consent;
  • for the purpose of compelling legitimate interests pursued by the DC or by the DP, which are not overridden by the interests, rights and freedoms of the data subject and when:
    • transfer is not repetitive and concerns only a limited number of data subjects;
    • the data controller or the data processor has assessed all the circumstances surrounding the data transfer and has, on the basis of that assessment, provided suitable safeguards with regard to the protection of personal data;
  • for the performance of international instruments ratified by Rwanda. 

The DC or DP transferring personal data outside of Rwanda must enter into a written contract with the transferee setting out the respective roles and responsibilities of each party to ensure compliance with the Data Protection Law (article 49). 

A regulation from the NCSA determining the form of contract to be used for transfers of personal data outside Rwanda is yet to be adopted (article 49).