Resources · Rwanda

Rwanda's data protection law and e-signatures

Last reviewed 18 October 2026 · General information, not legal advice

Every contract you send for signature carries personal data: names, emails, phone numbers, ID numbers, salaries. In Rwanda, that data is covered by Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. Here is what the law says about storing and transferring it, and what to ask any e-signature provider.

Key facts

• Law N° 058/2021 requires data controllers and processors to store personal data in Rwanda unless they hold a valid certificate authorizing storage outside Rwanda (Article 50).²
• Anyone who intends to act as a data controller or data processor must register with the supervisory authority, NCSA (Article 29).³
• Gewape Cloud Rwanda Limited is registered with NCSA as a data controller (No. 001/0130/1225) and a data processor (No. 002/0018/1225).
• GewapeSign stores documents, signer details and audit records in Kigali, Rwanda.

As of 18 October 2026.

Controller and processor: who is who

When you send a document for signature, your organization decides what is in it, who signs and why. That makes you the data controller. Your e-signature provider processes the data on your instructions, as your data processor. Both roles carry obligations under the law, and both must be registered with the supervisory authority.³

Where the data must be stored

Article 50 says a data controller or data processor stores personal data in Rwanda. Storage outside Rwanda is permitted only if the controller or processor holds a valid registration certificate authorizing it.² Article 48 adds conditions for sharing or transferring personal data to a third party outside Rwanda, such as prior authorization from the supervisory authority with proof of appropriate safeguards, or the data subject's consent.²

How long to keep it

Article 52 says personal data is kept until the purposes of the processing are fulfilled, with longer retention allowed on the grounds the article lists, such as a legal requirement or a contract. When the period ends, the data must be destroyed so it cannot be reconstructed.² For signed agreements, decide your retention period with your legal counsel. In GewapeSign, documents and audit records are kept for as long as your organization keeps them in its account.

Questions to ask any e-signature provider

1. In which country are documents, signer details and audit records stored, including backups?
2. Which other companies process them, for example for email, storage, analytics or AI features?
3. Is the provider registered with NCSA as a data processor, and can it show its registration numbers?
4. Can you download every signed document with its evidence if you leave?

GewapeSign's answers

Documents, signer details and audit records are stored in Kigali, Rwanda, with encrypted backups in a second location in Rwanda, and are never passed to outside services. Gewape Cloud Rwanda Limited is registered with NCSA as a data controller (No. 001/0130/1225) and a data processor (No. 002/0018/1225), issued 16 December 2025 and valid until 16 December 2027. Finished documents download as PDF files with their certificates and stay valid outside GewapeSign. See security and data residency and the Privacy Notice.

Back to the overview: Electronic signatures in Rwanda.