Security testing for Rwanda's Data Protection Law and NCSA compliance

What Law No. 058/2021 and the NCSA require

Rwanda's Law No. 058/2021 governs the protection of personal data. It is supervised by the National Cyber Security Authority (NCSA), the data-protection supervisory authority. Registration of data controllers and processors is mandatory, and a Data Protection Officer is required where applicable. The compliance transition period ended on 15 October 2023, so the law is now in force and enforcement is active.

Two obligations matter most for security testing. First, controllers and processors must implement "appropriate technical and organisational measures" to protect personal data. Second, where a personal data breach occurs, the law sets a short notification window: notification to the supervisory authority within 48 hours (Article 43) and a fuller report within 72 hours (Article 44). The law does not prescribe a specific test or a fixed test cadence, which leaves each organisation to demonstrate that its technical measures are real and effective.

Who must comply: government, healthcare, telecom, fintech, any data holder

This is the part that surprises many organisations. The data-protection regime is not limited to banks supervised by the National Bank of Rwanda. It reaches any organisation that handles personal data about people in Rwanda:

• Government bodies and agencies: citizen registries, service portals, and the systems that store identity and benefit data
• Healthcare providers: hospitals and clinics holding patient records, diagnostics, and billing data
• Telecom operators: subscriber data, call and location records, and the platforms behind mobile services
• Fintechs and financial firms: wallet and payment data, KYC records, and partner-facing APIs
• Any other data holder: insurers, schools, NGOs, and private companies that collect customer or employee data

If your organisation collects, stores, or processes personal data, the obligation to protect it with appropriate technical measures applies to you. Banks supervised by the BNR carry an additional, more prescriptive testing obligation, covered on our BNR-compliant penetration testing page.

How security testing demonstrates "appropriate technical measures"

The law asks you to protect personal data with appropriate technical measures, but it leaves you to prove those measures hold. A manual penetration test does exactly that. It attempts to reach the personal data the way an attacker would, across your applications, APIs, networks, and cloud, and documents what it found with proof-of-concept evidence, severity ratings, and prioritised fixes. That report is concrete evidence that you tested your controls, identified the gaps, and remediated them. It is not a substitute for registration, a Data Protection Officer, or a formal attestation; it is the technical layer that supports them. For the full scope of what manual testing covers, see our penetration testing service.

What we deliver

We run the engagement by hand, not as a repackaged scanner report, and we structure the output so it supports your data-protection programme:

• Scoped penetration test: manual testing focused on the systems that hold or move personal data, with findings chained to show real impact
• Evidence-led report: executive summary, technical findings with proof-of-concept evidence and CVSS v3.1 ratings, and prioritised remediation guidance
• Personal-data exposure focus: a clear view of where personal data could be reached, which maps directly to the technical-measures obligation
• Free retest: verification testing after you remediate, with a clean retest report for your records and your auditor
• Live debrief: a walkthrough with your technical team and management, so the findings are understood, not just received

How an engagement runs

Frequently asked questions

For banks supervised by the National Bank of Rwanda, the regime is more prescriptive: see our BNR-compliant penetration testing page. For the full scope of our manual testing across web, network, mobile, API, and cloud, see our penetration testing service.