Resources · Rwanda

Electronic signatures in Rwanda: the law, the rules and how GewapeSign fits

Last reviewed 18 October 2026 · General information, not legal advice

If you run a business in Rwanda, you can get most agreements signed electronically. Rwandan law has recognized electronic signatures and electronic contracts since 2010, and since 2021 it has also set rules for where personal data, including the data in your contracts, must be stored. This page explains both laws in plain language, lists the documents that still need other formalities, and shows how GewapeSign, an e-signature service built and run in Kigali, fits those rules.

Key facts

• Rwanda recognizes electronic signatures and electronic contracts under Law N° 18/2010 of 12/05/2010 relating to electronic messages, electronic signatures and electronic transactions.¹
• Rwanda's data protection law, Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, requires personal data to be stored in Rwanda unless the controller or processor holds a valid certificate authorizing storage outside Rwanda (Article 50).²
• GewapeSign stores documents, signer details and audit records in Kigali, Rwanda, with encrypted backups in a second location in Rwanda.
• Gewape Cloud Rwanda Limited is registered with NCSA as a data controller (No. 001/0130/1225) and a data processor (No. 002/0018/1225), valid until 16 December 2027.
• GewapeSign is priced in Rwandan francs, from RWF 5,000 per user each month. The first 5 documents are free and signers never pay.

As of 18 October 2026.

The short answer

An electronic signature is legal in Rwanda for most commercial documents. Law N° 18/2010 of 12/05/2010 relating to electronic messages, electronic signatures and electronic transactions says an electronic message is valid and cannot lose its legal effect only because it is electronic, that an electronic signature can meet a legal requirement for a signature, and that contracts can be formed by electronic messages.¹ A few documents are excluded from the law, and some documents have their own formalities under other laws. For those, ask your legal counsel before you sign electronically.

The second rule is about data. Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy requires personal data to be stored in Rwanda unless the controller or processor holds a valid certificate authorizing storage outside Rwanda.² Contracts are full of personal data: names, emails, ID numbers, salaries, addresses. So where your e-signature provider stores them matters.

The e-signature law: Law N° 18/2010

Law N° 18/2010 was published in the Official Gazette n° 20 of 17/05/2010, in Kinyarwanda, English and French.¹ It covers electronic messages, electronic signatures and electronic transactions. The provisions that matter most for signing agreements are these:

• Legal recognition (Article 3). An electronic message is valid under the law and is not invalid merely because it is in electronic form.
• Writing (Article 4). Where the law requires information in writing, an electronic message meets that requirement if the information in it stays accessible for later use.
• Original documents (Article 5). Where the law requires an original, an electronic message meets that requirement if there is reliable assurance that the information has stayed complete since it was first created in its final form, and it can be accessed when needed.
• Signatures (Article 20). Where the law requires a person's signature, an electronic signature meets that requirement if the method identifies the person and shows that they approve the content, and the method is reliable and appropriate for the purpose, including under any agreement between the parties.
• Technology neutrality (Article 21). All electronic signatures are valid, whatever the technology used, as long as they conform to the law.
• Contracts (Article 72). Unless the parties agree otherwise, an offer and its acceptance can be expressed by electronic messages, and a contract formed that way is valid.

The law also sets out secure electronic signatures and certificate-based digital signatures issued through licensed certification authorities (Articles 28 to 48 and 66 to 71).¹ Those are optional tools for situations that need them; the general rules above apply to ordinary electronic signatures too.

Documents the law excludes

Article 1 says the law does not apply to these documents, which still need the formalities the law sets for them:¹

• a will;
• negotiable instruments, such as bills of exchange and promissory notes;
• a power of attorney;
• a commercial agreement or other document relating to immovable property, or any interest in such property.

Other laws can add their own requirements for particular documents, for example where a notary, a public authority or a registry must be involved. When in doubt, ask your legal counsel before you send a document for electronic signature.

Electronic signatures as evidence

Article 6 says electronic messages are admissible as evidence in legal proceedings and cannot be refused only because they are electronic, and Article 20 says the same for electronic signatures.¹ That settles admissibility. How much weight a court gives a particular signature still depends on the facts: who signed, how they were identified, when they signed and whether the document changed afterwards.

That is why the record behind a signature matters. For every document, GewapeSign keeps an audit trail of each step with the time, the signer's name and email, and their network address; seals the finished PDF so any later change shows; records its SHA-256 fingerprint; and adds an independent, timestamped proof that anyone can check at gewapesign.com/verify. This is general information; for a dispute, take advice from a Rwandan lawyer.

Data protection: Law N° 058/2021

Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy applies to anyone who processes personal data in Rwanda. The National Cyber Security Authority (NCSA), through its Data Protection and Privacy Office, is the supervisory authority.²³ Three parts matter when you choose an e-signature service:

• Registration (Article 29). Anyone who intends to act as a data controller or a data processor must register with the supervisory authority.³ The Data Protection and Privacy Office publishes a registration guide.⁴
• Storage in Rwanda (Article 50). A data controller or data processor stores personal data in Rwanda. Storage outside Rwanda is permitted only if it holds a valid registration certificate authorizing storage outside Rwanda.²
• Transfers outside Rwanda (Article 48). Sharing or transferring personal data to a third party outside Rwanda is allowed only on the grounds the article lists, such as prior authorization from the supervisory authority with appropriate safeguards, or the data subject's consent.²

Many international e-signature services store documents in the United States, Europe or Asia. If you use one, ask how it meets these rules for your documents. Read more in Rwanda's data protection law and e-signatures.

GewapeSign's NCSA registrations

Gewape Cloud Rwanda Limited, the company that runs GewapeSign, is registered with the National Cyber Security Authority, Data Protection and Privacy Office, under Law N° 058/2021:

• Data controller · registration No. 001/0130/1225
• Data processor · registration No. 002/0018/1225

Both were issued 16 December 2025 and are valid until 16 December 2027. For the documents you send, you are the data controller and we process the data on your instructions as your data processor. For account and billing details, we are the data controller. See the Privacy Notice.

How GewapeSign fits

• Stored in Kigali. Documents, signer details and audit records are stored in Kigali, Rwanda, with encrypted backups in a second location in Rwanda. They are never passed to outside services.
• Evidence for every document. Audit trail, completion certificate, sealed PDF, SHA-256 fingerprint and an independent timestamped proof. See audit trail and proof.
• Easy for signers. Signers need no account and never pay. They sign on any phone or computer.
• Built for recurring business. A paid invoice can send the contract, renewals go out before they are due, and a declined renewal stops the invoice. See billing automation.
• Rwandan company, Rwandan law. GewapeSign is run by Gewape Cloud Rwanda Limited in Kigali, and its Terms of Service are governed by the laws of Rwanda.

What GewapeSign does not do: it is not a licensed certification authority and does not issue digital signature certificates under Law N° 18/2010. If a law or a counterparty requires that kind of signature for a document, check before you rely on GewapeSign.

Who uses e-signatures in Rwanda

• Banks and insurers: customer agreements, policy schedules and consent forms, kept in Kigali with an audit trail.
• Telecoms and ISPs: service orders, upgrades and renewals signed the moment a customer pays.
• HR teams: offer letters, employment contracts and policy acknowledgements signed from any phone.
• Public-sector suppliers: tender and supplier paperwork with evidence ready for any review.
• Small businesses: quotes, NDAs and service agreements, starting free.

Pricing in Rwandan francs

GewapeSign is priced in Rwandan francs, per user each month: Starter RWF 5,000, Business RWF 9,000 and Scale RWF 15,000. Enterprise is quoted. The first 5 documents are free, for one user, with no card and no time limit. Prices exclude VAT, which is added at checkout based on your location, and yearly billing saves 15%. Signers never pay. See pricing (as of 18 October 2026).

A checklist before you switch

1. List the documents you sign most often, and mark any that fall under the exclusions in Article 1 or need a notary or registry.
2. Ask each provider where documents, signer details and audit records are stored, and who else processes them.
3. Check that your own organization is registered with NCSA if it processes personal data.³
4. Decide what evidence you need to keep, and for how long, and confirm you can download it.
5. Start with one document type, such as offer letters or service orders, then expand.