Law relating to the Protection of Personal Data and Privacy — personal data breach notification

Rwanda gives 48 hours, not 72: a controller must notify the National Cyber Security Authority within 48 hours of becoming aware of a personal data breach, and a processor must inform its controller within 48 hours of discovery. That is among the tightest windows in this dataset and it sits alongside Rwanda's mandatory registration regime for controllers and processors, so a business caught by the law is already known to the regulator when an incident happens. Penalties under the law include administrative fines calibrated to global turnover for corporate offenders. Marked 'check': the 48-hour figure was triangulated across independent legal-reference sources rather than read in the Official Gazette text, and the NCSA has continued to issue implementing guidance.