Does Cyber Crucible comply with Rwanda's data protection law?

Short answer: Yes. Rwanda's data protection law is supervised by the National Cyber Security Authority, and sector-specific rules add localization obligations — notably for licensed banks, which must maintain primary data within Rwanda. The on-premises deployment satisfies both.

What the law requires

Rwanda enacted a data protection law with the National Cyber Security Authority (NCSA) designated as supervisory authority; its data protection office launched in March 2022.

Alongside the general law, sectoral regulation adds localization: cyber security regulation requires banks licensed by the Central Bank to maintain primary data within Rwandan territory.

Why the sectoral rule matters most

For financial services in Rwanda, the banking localization requirement is usually the binding constraint — stricter and more specific than the general data protection provisions. A security product deployed across a bank's endpoints processes data that falls within it.

What specifically applies here

• On-premises deployment keeps primary data within Rwanda, satisfying the localization requirement directly.
• Local analysis means protection does not depend on any out-of-country service.
• Supervisory alignment — with NCSA as both cyber security and data protection authority, being able to evidence what a security tool collects, in enumerated terms, is unusually useful.

Status at time of writing — confirm current general and sectoral requirements with local counsel.