Data management in the modern age: Rwanda’s pioneering steps
In today’s interconnected world, data management is a critical pillar for organizational success. From the collection of data to its utilization, effective data management ensures accuracy, accessibility, and compliance with regulations—a cornerstone in the evolving landscape of digital operations.
Rwanda’s data protection journey
Over the past decade, data protection has undergone a profound evolution, catalyzed by the exponential surge in data volume, complexity and the realization of all the potential that data has in impacting the success or otherwise of a business. This transformation powered by digital adoption has propelled businesses, regardless of size, to embrace cloud-based solutions and dispersed data architectures. Yet, this digital leap has unveiled both unprecedented business prospects and challenges, particularly concerning data security.
Acknowledging the paramount significance of safeguarding data, Rwanda took a momentous step on October 15th, 2021, by officially enacting Law No 058/2021. This legislation stands as a beacon, ensuring explicit consent from individuals regarding the collection, storage, and processing of their personal data, placing Rwanda in alignment with international data protection standards essential for thriving in the digital economy. This law came into force on 15th October 2023 after a grace period of two years giving all entities dealing in data both personal and otherwise enough time to put in place different measures to ensure data protection and privacy.
Navigating compliance in Rwanda’s digital era
The law, a pivotal milestone, imposes essential obligations on both public and private sectors. It mandates entities to register as data controllers or processors, appoint dedicated data protection officers, and fortify security measures. Non-compliance bears consequences, ranging from administrative fines to a percentage of global turnover for corporate entities, underlining the criticality of adherence.
However, a comprehensive Data Maturity Assessment conducted within the Private Sector Data Acceleration Program revealed gaps in data privacy and protection in the accessed companies. These gaps, particularly evident in the absence of designated officers, lack of compliance procedures, and a lack of awareness about the law’s significance, pose significant challenges to effective data management.
Empowering compliance through strategic collaboration
In response to the highlighted challenges, the Rwanda ICT Chamber joined forces with the CERTA Foundation to orchestrate a transformative initiative. The cornerstone of this collaboration was the training and certification of Data Protection Officers (DPOs). Fifteen individuals underwent an extensive training program, equipping them with the expertise needed to navigate the complexities of data protection laws in Rwanda.
Of the certified cohort, five individuals were awarded internships in the program and are currently actively assisting companies in their compliance journey. These trained officers are pivotal in guiding organizations through registration processes and aiding in the development of essential documentation, thereby ensuring adherence to data protection laws and fostering a culture of compliance. They also ensure that the companies and their employees are aware of the data privacy and protection law of Rwanda and are upholding this law in all aspects of their work. This will safeguard these companies from penalties and fines during audits that the National Cyber Security Authority could conduct at any given time on a data producing company that is certified or not.
Testimonials: Voices of success
The impact of this initiative resonates through the feedback of program beneficiaries. Their testimonials underscore the program’s role in enhancing expertise and fostering a comprehensive understanding of data security measures.
During the journey, trainees shared testimonies highlighting how the training helped shape their careers and the company emphasized the importance of trained DPOs in achieving compliance.
INTWARANE Abiel, a certified DPO by the Private Sector Data Acceleration Program, now an Associate/Data Protection Officer at LandMark Advocates, mentioned how the training equipped him with skills and knowledge, enhancing his expertise in implementing effective data protection measures. He said “Participating in the Data and Privacy Protection training has proven to be an invaluable investment in my professional development. The interactive nature of the sessions not only made the learning experience engaging but also facilitated a deeper understanding of the complex concepts surrounding data security. Since the training extended beyond theoretical knowledge. The comprehensive foundation laid during the training has since become a cornerstone for my ongoing professional growth. In the aftermath of the program, I have been able to build upon the knowledge gained, further honing my expertise in data and privacy protection.”
Ms.Naima Nikuze, also a certified DPO in the Private Sector Data Acceleration Program and currently undergoing internship in the program had this to say: “This internship exposed me not just to data protection but also to cybertechnology. As a Junior Corporate Lawyer working in an increasingly technological world, we require greater data security through data protection and privacy. I thank ICT chamber for this chance, which has taught me not only about data protection but also about teamwork and work ethics with everyone in this data acceleration programme. I have also had an opportunity to work with prominent companies during my internship like East Africa Exchange, Water Access Rwanda and IPOSITA therefore widening my experience in indifferent sectors and work environments that produce data. I am confident that I am better equipped to take up more assignments after this internship is complete”
Mr. Leon Eustache KANAMUGIRE, the CEO of DDIN said “At DDIN (Digital Distribution Inclusion Network), we recognize the critical importance of data security, privacy, and compliance in today’s digital landscape. Our collaboration with the Rwanda ICT Chamber under the Private Sector Data Acceleration Program has been instrumental in achieving a robust approach to data moderation and maintaining a high level of data compliance. The DPO allocated to our company has played a great role in supporting us in the registration of our company at the National Cyber Security Authority and we are currently approved as data processor and data controller.”
Through the program we have been able to enhance data security, ensure regulatory compliance, put in place risk mitigation measures, have a cultural shift with regards to how we handle our data as individuals in the company and put in place an effective incident response plan. In conclusion, the Rwanda ICT Chamber’s Private Sector Data Acceleration Program has been a catalyst for positive change within our organization. The presence of trained DPOs has not only elevated our data protection standards but has also positioned us as a responsible and compliant entity in the eyes of our stakeholders.The program has been instrumental in shaping the future of data security and compliance in Rwanda.
Charting the future of data protection
Data protection and privacy is now a very serious matter in Rwanda and all companies big and small need to adhere to the Data Protection Law. With the fresh availability of Certified Data Protection Officers, companies have affordable support to help them to comply with the law. The Private Sector Data Acceleration Program in ICT Chamber remains driven to support private companies as the future of business is in the data they possess and what they can do with this data. It is said that data is the new gold, but raw gold has less value than gold that has been turned into ornaments that people can actually use. Data subjects who are the ones who provide useful data to businesses are now more aware of their rights and need to be confident that their information is being used correctly before providing a business any of their personal information that the company in turn needs in order for them to provide better services and get profits.