Localisation & sovereignty

Personal data must be stored in Rwanda; storage outside Rwanda is only permitted if the controller/processor holds a valid registration certificate authorising storage outside Rwanda, issued by the supervisory authority (Art. 50).

Verbatim captured; the DPO's official services menu ('Authorization to Store Outside Rwanda') corroborates operationally. MATERIAL DIFFERENCE vs Uganda: no equivalent default-localisation provision captured in Uganda's Act. Direct colocation-demand driver for in-country Rwandan facilities.

The default rule for non-adequate destinations is restrictive (s.32): 'transfer of personal data to countries outside the United Republic is not authorised' except in enumerated cases (consent, necessity and others); operationally the PDPC 'Issues permits to entities intending to transfer personal data outside the country', assesses destination-country adequacy, requires safeguards prior to transfer, sets conditions and monitors/audits adherence.

MATERIAL DIFFERENCE, both T1: Tanzania operates a pre-approval PERMIT regime (like Rwanda's Art. 48/50 authorisation model), vs Uganda's records-based regime with no advance approval (UG-DP-C5). Direct colocation-demand driver for in-country facilities.

Kenya's regime imposes no general data-localisation mandate: in-country storage is not a blanket precondition, and cross-border movement is governed by the DPA's transfer conditions - materially lighter than Rwanda's registration-certificate-based storage rule.

Negative/material-difference claim, deliberately held at partially-verified: absence is asserted only until the DPA text is captured in full. Upgrade path: DPA 2019 full-text capture; cross-check against the ODPC guidance pages. | r10 upgrade: DPA statute text (T1, 2026-09-22) evidences conditions-not-prohibition; comparative limb rests on captured T1 instruments of both countries - flagged for editor eye.