Privacy Policy

Thank you for visiting the  Rwanda information society authority (RISA) website and reviewing our privacy policy.

In accordance with Rwanda’s Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy (DPP Law), and other international laws on personal data and privacy such as the GDPR, this privacy policy explains how RISA  will use your personal data when you visit our website.

RISA respects your privacy. This Policy applies to the RISA website, platforms, and services that display or provide links to this Policy.

This Policy describes how we process your personal data, and aims to address all possible data processing scenarios that may. RISA  may inform you of product- or service-specific data collection through supplementary policies or notices provided before collection.

This Policy describes:

  1. Why is data collected and further processed

  2. How We Collect & Use Your Personal Data

  3. Cookies & Similar Technologies

  4. How We Disclose Personal Data

  5. How to Access & Control Your Personal Data

  6. How We Protect Your Personal Data

  7. How We Process Children’s Personal Data

  8. Third-Party Providers and Their Services

  9. International Transfers of Your Personal Data

  10. Updates to This Policy

  11. How to Contact Us

1. Why is data collected and further processed? 

  • The data we process is collected from the following sources:

  • Digital certificate request

  • Making an inquiry or requesting information

  • Providing feedback

  • Subscribing to our newsletters

  • Signing a contract /MOU or any other legal document with us as a Data Controller of Data processor under the DPP Law

  • Any other interaction with us including through our social media platforms


Personal data means any data that, either on its own or jointly with other data, can be used to identify a natural person. You directly provide us with such data when you use our websites, or interact with us by, for example, engaging RISA for the provision of our services. We may also obtain data by recording how you interact with our website. For example, we may use technologies like cookies or receive use data from software running on the website.

We also collect the information you provide to us and the content of messages you send us, such as the query information you provide, or the questions or information you provide through our contact page.

In addition, RISA uses Google Analytics measurement software to help improve the experience of visitors using the RISA website. RISA uses the following Google Analytics tracking data for website improvement


We may use your personal data for the following purposes:

  • Fulfilling your service requests or receiving services from you

  • Contacting you with your consent; sending you information about our services that may interest you or help us serve you better. If you do not want to receive these types of information, you can opt out at any time.

  • Assessing your suitability for potential employment or other contractual engagement;

  • Submission of documents to our clients including expressions of interest, capability statements, and tenders; and

  • Compliance with all relevant laws, court/tribunal orders, or enforcement-related activities



To ensure our website works correctly, we may at times place a small piece of data known as a cookie on your computer or mobile device. RISA  uses cookies to improve the user experience for example to remember your settings such as language, font size on your computer or mobile device, or other browser preferences.

RISA will not use cookies for any purposes not stated in this Policy. You can manage or delete cookies based on your own preferences. You can clear all the cookies stored on your computer, and most web browsers provide the option of blocking cookies.


Information about our clients is an important part of our business and we address sharing of your data as such. We may disclose Personal Information that we collect from you for the purpose(s) that it was collected. We may disclose the Personal Information for other purposes where we have received your consent to do so or are required to do so by law.

Examples of where we may disclose your information include, but are not limited to:

  • To comply with applicable laws or respond to valid legal procedures, RISA may disclose your personal data to law enforcement or other government agencies.

  • If RISA is involved in a restructuring, merger & acquisition, or a bankruptcy or liquidation lawsuit in a given jurisdiction, your personal data may be disclosed in connection with the transaction.

  • To execute a contract in the provision of our service, when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss of our clients, or when it is in connection with an investigation of suspected or actual illegal activity.

We will take reasonable steps to ensure that the Personal Information we use or disclose is accurate, up to date, complete and relevant to the purpose of the use or disclosure.


It is your responsibility to ensure that all personal data submitted to RISA  is correct. RISA  is dedicated to maintaining the accuracy and completeness of personal data and keeping the data up-to-date.

To the extent required by applicable law, you may

  • have the right to access certain personal data we maintain about you

  • request that we update or correct inaccuracies in that data

  • object or restrict to our use of your personal data, and

  • ask us to delete your personal data from our platforms.

To exercise these rights, you may contact RISA Directly through the contacts provided in this policy.



The security of your personal data is important to us and is our highest priority. We use appropriate physical, management, and technical measures to protect your personal data from unauthorized access, disclosure, use, modification, damage, or loss.

  • We use cryptographic technologies for data confidentiality, protection mechanisms to prevent attacks, and access control mechanisms to permit only authorized access to your personal data.

  • We provide training on security and privacy protection for employees to raise their awareness of personal data protection.

  • We maintain physical, electronic, and procedural safeguards in connection with the collection, storage, and disclosure of personal information


We will retain your personal information for no longer than is necessary for the purposes for which it was received unless otherwise extending the retention period is required or permitted by law. We maintain a detailed retention schedule for Personal Information which is informed by the following principles:

  • In the first instance, Personal Information will be retained as long as required by a relevant law (e.g. to ensure compliance with tax requirements);

  • If a relevant law no longer requires us to maintain Personal Information (or that period has elapsed), the Personal Information may then still be retained if required by any relevant contractual agreement or arrangement; and

  • For Personal Information to which a relevant law or contractual agreement or arrangement does not apply, we will retain the Personal Information for as long as is required to manage our engagement and/or relationship with you plus a reasonable period afterward. As a general rule, for information collected during project execution, we will only retain the data after project completion, after which we shall provide our customer with a copy of the same and delete the data from our systems


Our website, services, and products are primarily intended for adults. For special cases such as our Corporate Social Responsibility activities, information regarding persons under the age of 18 will only be processed with the explicit consent of the child’s parents or guardians.


With operations in Rwanda, your personal data collected by RISA  may be processed or accessed in the country/region where you use our products and services. These jurisdictions may have different data protection laws. In such circumstances, RISA  will take measures to ensure that data is processed as required by this Policy and applicable laws


RISA  reserves the right to update or change this Policy at any time. We will release the latest Privacy Policy on our website and appropriate channels for any changes. If major changes are made to the Privacy Policy, we may notify you through different channels, for example, posting a notice on our website or sending you a direct notification.


If you have any concerns regarding our privacy policy or the use of your information, please contact the Data Controller at:


Phone: 4046

Address: Telecom House 8 KG 7 St, Kacyiru, Kigali P.O. Box 6603 Kigali-Rwanda