Rwanda has established a regulatory framework to control the importation of used information and communication technology (ICT) equipment. Ministerial Guidelines No. 1 of 25 October 2011 prohibit the import of used computers for commercial purposes into Rwandan territory (Art. 6). Nevertheless, Arts. 7 to 14 outline specific exemptions, including imports for educational institutions and personal use. Complementing these provisions, Regulation No. 5/2022, which governs the trade in used electrical and electronic equipment, introduces a licensing regime for the importation of such goods. The list of authorised used equipment permitted for importation and marketing is detailed in Annex II to the Regulation.

It has been reported that import duties are applied inconsistently; for instance, local customs officials have attempted to charge importers duties based on their perception of the value of an import, regardless of the actual purchase price. This may limit the volume of ICT products that can be imported.

In Rwanda, a Simplified Type Approval Regime is issued following a third-party certification from Conformity Assessment Bodies recognised by the Regulatory Authority; as such, there is recognition of test reports and certificates.
Under Art. 17 of Regulation No. 011/R/STD-ICT/RURA/020 of 29/05/2020, Governing Importation, Supply and Type Approval for Electronic Communication Equipment, the Electronic Communications Equipment (ECE) that possesses the appropriate Certificate of Compliance from either a National Regulatory Authority or a Conformity Assessment Body recognised by the Regulatory Authority confirming compliance with the required standards may be eligible for Simplified Type Approval Regime.
Additionally, under Art. 35, any test report from an accredited testing laboratory is only accepted by the regulatory authority if it is in compliance with ISO/IEC 17025 and/or certified by an accreditation body that is a member of ILAC.

Under the Guidelines for Siting and Sharing of Telecommunication Base Station Infrastructure (2011) and Law No. 24/2016 of 18/06/2016 Governing Information and Communication Technologies, Rwanda has established a regulatory obligation for passive infrastructure sharing to support the delivery of telecommunications services to end users.
According to Section 4.2.4, when requested by another licensee, each operator or service provider must disclose complete information on the location and technical specifications of their towers within a maximum of 10 working days. Furthermore, within an additional 10 working days, the operator must grant escorted access to the site upon request by another licensee seeking to assess the feasibility of infrastructure sharing.
Furthermore, pursuant to Art. 71 of Law No. 24/2016 licensed network operators must share the use of their electronic communications infrastructures on agreed upon terms and conditions.

Art. 30 of Regulation No. 18/R/SM-ICT/RURA/2024, concerning access to operators’ databases by the regulatory authority, stipulates that the authority shall be granted access to the SIM card registration database without a court order. Licensees must also permit authorised officers to access their systems, premises, facilities, and all relevant records and data, to facilitate inspections and ensure compliance with the Regulation. Also in this case, the law does not require a court order. This Regulation repeals Regulation No. 004/ICT/RURA/2018, which contained a similar provision under Art. 25.

In 2013, the Rwandan government and Korean Telecom (KT) entered into a 25-year agreement to establish a 4G wholesale network in the country. As part of the partnership, the Rwandan government acquired a 49% stake in KT Rwanda networks Ltd (KTRN), with the remaining 51% owned by Korean Telecom.

Law No. 18/2010 establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 8, intermediaries and telecommunications network service providers are absolved of liability for the contents of documents or electronic messages transmitted through their networks by an individual. This liability applies to the creation, publication, and dissemination of electronic messages on the network and the use of such electronic messages in contravention of the law.
Furthermore, under Art. 10 of the same law, telecommunications operators and intermediaries are not liable for providing access to information, transmission or its retention as long as they do not initiate the transmission of the information or select the addressee and cannot modify the electronic communication. Under Art. 11, an intermediary or a certification authority shall not be liable for the automatic, intermediate, and temporary storage of that electronic record, in case the intention of such storage of electronic record is its onward transmission to other recipients who requested for it.
Additionally, under Art. 12, an intermediary that provides a service comprising the storage of electronic messages shall not be liable for damages arising from information stored if it is not aware that the information or the activity relating to the information infringes any person. Under Art. 13, an intermediary shall not be liable for damages incurred when it links its services with other websites containing electronic messages or activities that do not fulfil legal requirements. Arts. 188-192 of the Law Governing Information Communication and Technologies outlines the limits to liability to electronic service and network providers, limits of caching, hosting, and relating to information local tools.

It is reported that Rwanda does not mandate functional separation for operators with significant market power (SMP) in the telecom market. Yet, the country mandates accounting separation under Art. 103 of Law No. 24/2016 of 18/06/2016 Governing Information and Communication Technologies. This is also confirmed by Art. 18 and Section 15 of Annex II of Regulation No. 013/R/EC-ICT/RURA/2021 of 25/02/2021 Governing Licensing in Electronic Communication.

Law No. 18/2010 establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 8 of the law, intermediaries and telecommunications network service providers are absolved of liability for the contents of documents or electronic messages transmitted through their networks by an individual. This liability applies to the creation, publication, and dissemination of electronic messages on the network and the use of such electronic messages in contravention of the law.
Furthermore, under Art. 10 of the same law, telecommunications operators and intermediaries are not liable for providing access to information, transmission or its retention as long as they do not initiate the transmission of the information or select the addressee and cannot modify the electronic communication. Under Art. 11, an intermediary or a certification authority shall not be liable for the automatic, intermediate, and temporary storage of that electronic record, in case the intention of such storage of electronic record is its onward transmission to other recipients who requested for it.
Additionally, under Art. 12, an intermediary that provides a service comprising the storage of electronic messages shall not be liable for damages arising from information stored if it is not aware that the information or the activity relating to the information infringes any person. Under Art. 13, an intermediary shall not be liable for damages incurred when it links its services with other different websites containing electronic messages or activities that do not fulfil legal requirements. Arts. 188-192 of the Law Governing Information Communication and Technologies outlines the limits to liability to electronic service and network providers, limits of caching, hosting, and relating to information local tools.

Art. 29 of Annex 2 of Regulation No. 013/R/EC-ICT/RURA/2021 sets out the operational requirements that licensees must follow. This includes, but is not limited to, the purchase of equipment, construction, installation, and facility delivery. The Licensee must give priority to: (i) materials and products made in Rwanda; and (ii) service providers based in Rwanda, owned by Rwandan citizens or companies incorporated under Rwandan law with majority Rwandan ownership—provided this does not compromise safety, efficiency, or cost-effectiveness.
The Licensee is also required to prioritise the employment of Rwandan citizens across all operational phases, while maintaining safety, efficiency, and economy. In addition, it must provide training to Rwandan staff to support their advancement into managerial and technical roles. An annual report must be submitted to the Regulatory Authority detailing the strategies used to meet these obligations.

Rwanda has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that the Rwanda Utilities Regulatory Authority (RURA), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Art. 16 of the "Regulations No. 001/R/TD-ICS/RURA/016 of 06/05/2016 Governing Telecom Network Security in Rwanda" mandates that subscriber information held by a telecommunication service provider or internet service provider—including voice, SMS, and call data records—must be processed, stored, and transmitted securely within the territory of Rwanda. The provision explicitly prohibits the transfer, storage, or processing of such subscriber information outside national borders.

Art. 15 of "Regulation No. 010/R/CR-CSI/RURA/020 of 29 May 2020 Governing Cybersecurity" stipulates that the networks, systems, and applications of licensed ICT companies must not be managed, hosted, accessed remotely, or located outside the territory of Rwanda, unless explicit authorisation is granted by the Regulatory Authority.

Art. 50 of Law No. 058/2021 stipulates that all personal data must be stored within the territory of Rwanda, unless prior authorisation for its transfer and storage has been granted by the National Cyber Security Authority (NCSA). In addition, Art. 48 provides that a data controller or data processor may disclose or transfer personal data to a third party located outside Rwanda only under the following conditions:
- authorisation has been obtained from the NCSA upon submission of evidence demonstrating the implementation of appropriate safeguards for the protection of personal data;
- the data subject has provided informed consent;
- the transfer is necessary for specific purposes as outlined in the Law.