Rwanda Data Protection and SMS: Law 058/2021 Explained

If you send SMS to people in Rwanda, Law No 058/2021 on the protection of personal data and privacy applies to the phone numbers and names on your lists. In practice that means a lawful basis (often consent) for each purpose, respecting the right to object to direct marketing, registering with the National Cyber Security Authority (NCSA), and keeping the data in Rwanda unless your registration authorises storage abroad.

Last reviewed: 27 October 2026. This article is general information, not legal advice. For your specific case, consult a Rwandan lawyer or the NCSA's Data Protection Office.

Two sets of rules, one SMS

Every marketing SMS in Rwanda sits under two frameworks at once:

RURA's 2018 regulation on unsolicited commercial communications governs the message itself: identification, source of the number, opt-out, sending hours. We cover it article by article in Rwanda's 7pm to 7am SMS rule explained.
Law No 058/2021 governs the data behind the message: how you collect, store, use, share and delete the numbers and names on your list.

This article focuses on the second. It applies to transactional messages as well, because a list of customers for receipts is still personal data.

The law in brief

Law No 058/2021 of 13/10/2021 came into force on 15 October 2021, with a two-year transition for existing organisations, so full compliance has been expected since October 2023. The supervisory authority is the National Cyber Security Authority (NCSA), which runs a Data Protection Office. The law applies to processing of personal data of people in Rwanda, including by organisations based abroad.

Topic	What the law says (summary)	Article
Lawful basis	Processing needs a lawful basis, such as consent, contract, legal obligation or legitimate interests	46
Consent withdrawal	Consent can be withdrawn at any time	42
Children	For children under 16, consent comes from the person with parental responsibility	9
Direct marketing	People have the right to object to processing for direct marketing	19
Registration	Controllers and processors must register with the NCSA	29 to 31
Breach notification	Notify the NCSA within 48 hours of becoming aware of a breach	43
Data storage	Personal data stored in Rwanda, unless the registration certificate authorises storage abroad	50
Sensitive data	Includes health, religious beliefs and biometric data; extra safeguards required	3, 11
Administrative fines	RWF 2 million to 5 million, or 1% of global turnover for a company	53

Source: DLA Piper's summary of the law. Check the official text for the exact wording.

Consent: what it means for SMS lists

Consent is not the only lawful basis, but for promotional SMS it is usually the one you rely on. Compliance guides on Rwanda stress three points:

Freely given, specific and informed. A pre-ticked box or consent hidden in the terms is weak evidence. Ask a clear question: "Can we send you offers by SMS?"
Purpose-specific. A number collected for delivery updates does not automatically cover promotions. Ask separately.
Withdrawable. People can withdraw at any time, and under Article 19 can object to direct marketing. Your opt-out flow is how you honour this.

For transactional messages, the lawful basis is often the contract itself: you need the number to send the receipt or the delivery code. Say so in your privacy notice.

Record the source of every number

RURA's regulation requires a commercial message to state where the recipient's data came from (Article 7), and Law No 058/2021 expects you to be able to show your lawful basis. One record solves both. For each number, store:

where it was collected (store, website form, event registration);
when, and what the person was told;
which categories they agreed to (receipts, promotions, newsletter);
any opt-out, with date and channel.

Our developer guide Handling STOP in Rwanda when A2P SMS can't receive replies shows a simple schema for this.

Registering with the NCSA

Articles 29 to 31 require data controllers and processors to register with the NCSA. The application covers, among other things, the categories of data you process, the purposes, recipients, any countries the data is transferred to and the risks. DLA Piper notes that certificates are issued within 30 days.

For an SMS sender, the questions to answer are:

Are you a controller? If you decide why and how customer numbers are used, yes. A school, SACCO, shop or NGO sending its own SMS is a controller.
Who are your processors? Your SMS provider, CRM and hosting provider process data on your behalf. List them.
Where is the data? Name the countries where contact lists and message logs are stored.

The NCSA's Data Protection Office publishes guidance and compliance tools at dpo.gov.rw. Check there for the current registration process.

Data localisation: Article 50

Article 50 says personal data must be stored in Rwanda, and may be stored outside Rwanda only if the controller or processor holds a valid registration certificate authorising it. Transfers abroad also need a basis under Article 48 and a written contract with the recipient (Article 49).

For SMS senders, this affects more than the SMS platform:

a CRM or spreadsheet in a cloud region outside Rwanda;
a head office in another country that receives customer lists;
marketing tools that copy contact lists to their own servers;
message logs and delivery reports, which contain phone numbers and content.

If any of these apply, include the storage locations in your NCSA registration and get the authorisation in place. If you are unsure whether your set-up needs it, ask the NCSA.

Sensitive data and message content

The law treats health data, religious or philosophical beliefs, biometric data and several other categories as sensitive, and requires additional safeguards. For SMS this has two practical consequences:

Do not put sensitive data in the message. A clinic should send "your results are ready", not the result. Our healthcare use-case page has examples.
Some lists are sensitive in themselves. A church membership list reveals religious belief; a patient reminder list reveals health. Restrict access with team roles and never share these lists with sponsors or partners.

Breaches

If a contact list leaks, for example an exported spreadsheet shared by mistake, the controller must notify the NCSA within 48 hours of becoming aware, and processors must notify the controller within the same window. Where the breach is likely to cause high risk, the affected people must also be told. Have a short plan ready: who decides, who notifies, and what you tell customers.

A practical checklist for SMS senders in Rwanda

Map your SMS data: where numbers come from, where they are stored, who can access them.
Choose and document a lawful basis per purpose (contract for receipts, consent for promotions).
Collect promotional consent separately, and record its source.
Build an opt-out that works without replies, and honour it within 24 hours.
Register with the NCSA as a controller, listing your processors and storage locations.
Check Article 50 before storing data outside Rwanda.
Keep sensitive details out of message text.
Set retention periods for contact lists and message logs.
Write a 48-hour breach plan.

How eSMS Africa fits in

When you send through eSMS Africa, you remain the controller of your contact lists and eSMS Africa processes the data to deliver your messages. The dashboard supports the controls described above: team roles to limit who sees which lists, campaign approvals, an opt-out list that blocks future sends to opted-out numbers, and delivery reports as a record of what was sent. Sector-specific notes are on our Rwanda use-case pages, for example banks and SACCOs.

Frequently asked questions

Does Law No 058/2021 apply to a foreign company texting Rwandan customers?

According to compliance summaries, the law applies to processing of personal data of people located in Rwanda, including by organisations based abroad, and foreign organisations should check whether they need a local representative. Take local advice if this is your situation.

Is a phone number personal data?

Yes, when it relates to an identifiable person, which is almost always the case for a mobile number in a customer list. Names, message content and delivery records linked to the number are personal data too.

Do we need consent to send transactional SMS?

Not necessarily. Consent is one lawful basis among several. For receipts, OTPs and delivery updates, the contract with the customer is usually the basis. Explain this in your privacy notice and do not use those numbers for promotions without separate consent.

What are the penalties?

DLA Piper's summary lists administrative fines of RWF 2 million to 5 million, or 1% of the previous year's global turnover for a company, with separate criminal offences. RURA's regulation adds its own fine of RWF 50,000 to 500,000 for unsolicited commercial communications.

Sources

Want an SMS set-up that is easier to keep compliant? Read our Rwanda use cases by industry, then create a free eSMS Africa account and set up team roles, approvals and your opt-out list before your first send.