2025-09-11
The National Bank of Rwanda issues this policy to govern the lawful collection, processing, and retention of personal data from employees, financial institutions, contractors, and the public. It mandates that information be processed for regulatory supervision, policy formulation, and recruitment while maintaining technical safeguards, anonymization protocols, and restricted employee access. Data subjects retain rights to access, correct, or delete their records and must direct initial complaints to the Bank’s Data Protection Office before appealing to the National Cyber Security Authority within thirty days.