Skip to content

Evidence request lists

Rwanda DPL

Evidence request list. 8 controls, 8 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 12 September 2026. Published by The Art of Service.

Breach and Enforcement

RWANDA-8
Breach Notification, NCSA Cooperation, Enforcement

Per Rwanda Law 058/2021: breach notification to NCSA + incident response + enforcement awareness.

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-8
Where this commonly fails
  • NCSA registration + DPO + breach partial

Consent and Notice

RWANDA-2
Consent, Notice, Sensitive Data

Per Rwanda Law 058/2021: Consent Requirements + Special Categories of Personal Data. Maintain consent records + notices.

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-2
Where this commonly fails
  • NCSA registration + DPO + breach partial

Cross-Border

RWANDA-6
Cross-Border Transfer

Per Rwanda Law 058/2021: cross-border transfer with adequacy + safeguards + consent.

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-6
Where this commonly fails
  • NCSA registration + DPO + breach partial

Governance

RWANDA-7
Registration with NCSA, DPO Appointment, Governance

Per Rwanda Law 058/2021: Registration with NCSA + DPO appointment + training + records of processing.

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-7
Where this commonly fails
  • NCSA registration + DPO + breach partial

High-Risk Processing

RWANDA-4
Children, DPIA, Privacy by Design

Per Rwanda Law 058/2021: high-risk processing safeguards including children + DPIA + privacy by design.

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-4
Where this commonly fails
  • NCSA registration + DPO + breach partial

Individual Rights

RWANDA-3
Data Subject Rights

Per Rwanda Law 058/2021: data subject rights including access + rectification + erasure + object + portability.

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-3
Where this commonly fails
  • NCSA registration + DPO + breach partial

Scope and Lawful Basis

RWANDA-1
Scope, Lawful Basis, Principles

Per Rwanda Law 058/2021 on Personal Data Protection: scope + lawful basis. Requirements include (a) determine applicability + (b) Lawful Basis for Processing + (c) principles of processing + (d) document applicability + (e) align with NCSA (National Cyber Security Authority).

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-1
Where this commonly fails
  • NCSA registration + DPO + breach partial

Security

RWANDA-5
Security of Processing

Per Rwanda Law 058/2021: security per NCSA guidance.

Artefacts an auditor will ask for
  • Rwanda Law 058/2021 evidence for RWANDA-5
Where this commonly fails
  • NCSA registration + DPO + breach partial
Assembled from the framework's own control set. Every line traces to a control in the graph, so this pack is regenerated rather than written, and stays current as the graph does.

Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does.