Direct marketing continues to grow in importance as a business practice across a wide range of sectors. Such communications do, however, often entail processing of personal data and must therefore comply with applicable data protection rules.
Is consent (which can prove cumbersome to rely on in practice) as a legal basis under data protection legislation always necessary to send direct marketing communications?
In 2021, Rwanda published the law governing data protection (the first of its kind in the country): the Law n° 058/2021 of 13 October 2021 relating to the protection of personal data and privacy (the Data Protection Law), bringing the country in line with international data protection standards such as the GDPR.
This fairly new law applies to local and international companies that process personal data of data subjects located in Rwanda. It lays down an exhaustive list of 8 grounds to process personal data including the consent of the data subject and legitimate interests pursued by the party processing the personal data (Article 46 Data Protection Law).
