Art. 15 of "Regulation No. 010/R/CR-CSI/RURA/020 of 29 May 2020 Governing Cybersecurity" stipulates that the networks, systems, and applications of licensed ICT companies must not be managed, hosted, accessed remotely, or located outside the territory of Rwanda, unless explicit authorisation is granted by the Regulatory Authority.

Art. 50 of Law No. 058/2021 stipulates that all personal data must be stored within the territory of Rwanda, unless prior authorisation for its transfer and storage has been granted by the National Cyber Security Authority (NCSA). In addition, Art. 48 provides that a data controller or data processor may disclose or transfer personal data to a third party located outside Rwanda only under the following conditions:
- authorisation has been obtained from the NCSA upon submission of evidence demonstrating the implementation of appropriate safeguards for the protection of personal data;
- the data subject has provided informed consent;
- the transfer is necessary for specific purposes as outlined in the Law.

Art. 111 of "Law No. 007/2021 of 05/02/2021 Governing Companies" mandates that companies maintain specific records at their registered office or at any other location within Rwanda, for a minimum period of ten years from the end of the financial year to which the records pertain. The company is required to retain the following documents: its incorporation instruments; the register of shares and debentures; the index of shareholders; accounting records along with supporting documentation; a register of directors' interests; minutes of all general meetings and shareholders’ resolutions; minutes of all meetings and resolutions of directors and board committees; certificates issued by directors in accordance with this Law; copies of all annual financial statements, auditors’ reports, and directors’ reports; the internal register of beneficial owners; and copies of all written communications distributed to shareholders or to all holders of a particular class of shares, including annual reports.
Law No. 007/2021 repealed the law of the same title enacted in 2018, which contained a comparable provision to the one referenced above, albeit under Art. 114.

Art. 17 of the "Ministerial Instructions No. 001/MINICT/2012 of 12/03/2012 Related to the Procurement of Information and Communications Technology Goods and Services by Rwanda Public Institutions" stipulates that all government information technology systems and applications which process, store, or provide access to critical government data and information must be hosted within the National Data Centre (NDC). In addition, Art. 18 provides that, in instances where government institutions host applications in their own data centres or server rooms, they are required to obtain disaster recovery (backup) services from the NDC.

Rwanda has not joined any free trade agreement committing to open transfers of cross-border data flows.

Law No. 058/2021 provides a comprehensive regime of data protection in Rwanda. The Law introduces principles related to lawfulness, fairness and transparency, purpose limitation and accuracy, and obligations related to data subject rights, registration as a data controller or data processor, pseudonymisation, sensitive data, data transfers, designation of a data protection officer, Data Protection Impact Assessments, and data breach notifications.

Art. 18 of the Regulation Governing Licensing of Multimedia Services Provision requires multimedia services to ensure that the recordings are kept for 90 calendar days in case the Regulatory Authority requests a copy of any recording. Multimedia services are defined as "media services such as data or text, visual image, audio, audio-visual, offered to the end users through an electronic device including but not limited to online newspaper, Internet radio, Internet TV, audio and VoD, IPTV and mobile TV".

Rwanda has not signed the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Law No. 055/2024 on the Protection of Intellectual Property provides a framework for the effective protection of trade secrets. According to Art. 276, any act or practice, in the course of industrial or commercial activities, that results in the disclosure, acquisition, or use by others of secret information without the consent of the rightful holder and in a manner contrary to honest commercial practices constitutes an act of unfair competition. Under Art. 277 of the Law, an intellectual property owner harmed, or likely to be harmed, by an act of unfair competition has the right to initiate civil proceedings before the competent court or to request the cessation of such an act where, through an act contrary to honest industrial and commercial use, a manufacturer, trader, producer, or craftsman damages his or her credibility, takes away his or her customers, or harms his or her capacity for competition. Furthermore, as specified in Art. 380, any person who performs an act of unfair competition with respect to intellectual property commits an offence. Upon conviction, he or she is liable to a fine of not less than FRW 7,000,000 (approx. USD 5,300) but not more than FRW 10,000,000 (approx. USD 7,600).

Rwanda is not a signatory of the 1996 World Trade Organization (WTO) Information Technology Agreement (ITA) nor the 2015 expansion (ITA II).

According to Art. 73 of Law No. 031/2022, the procuring entity, through competition, gives preference to:
- Supplies or goods produced or manufactured in Rwanda;
- Consultancy and non-consultancy service providers registered as a domestic legal entity when procuring consultancy and non-consultancy services;
- A legal entity registered in Rwanda as a domestic legal entity when procuring for works; and
- An individual consultant operating in consultancy services.
Ministerial Order No. 001/23/10/TC determines the modalities for applying these preferences. According to Art. 62 of the Order, through competition, all procuring entities shall give exclusive preference to:
(i) Goods or supplies manufactured in Rwanda, when procuring goods or supplies with a value not exceeding FRW 200,000,000 (approx. USD 160,000); and
(ii) Service providers registered in Rwanda as domestic companies, for at least six months, when procuring non-consultancy services and consultancy services with a value not exceeding FRW 100,000,000 (approx. USD 80,000).

According to Art. 73 of Law No. 031/2022, the procuring entity, through competition, gives preference to:
- Supplies or goods produced or manufactured in Rwanda;
- Consultancy and non-consultancy service providers registered as a domestic legal entity when procuring consultancy and non-consultancy services;
- A legal entity registered in Rwanda as a domestic legal entity when procuring for works; and
- An individual consultant operating in consultancy services.
Ministerial Order No. 001/23/10/TC determines the modalities for applying these preferences. According to Art. 63 of the Order, price preference is used during the financial evaluation stage of bids for international or national tenders, in accordance with the following rules:
(i) A 15% local preference is granted to locally manufactured goods or supplies. When a bid includes both locally manufactured and imported goods or supplies, the preference applies only to the locally manufactured portion.
(ii) A 15% local preference is granted to companies registered in Rwanda as domestic companies for at least six months, when procuring consultancy and non-consultancy services.
Additionally, local preference is granted to joint ventures between a domestic and a foreign company, provided the domestic company fulfils at least 30% of the technical and financial requirements. However, this preference does not apply to tenders for consultancy services.

Rwanda is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

There is no restriction on foreign ownership. According to Art. 9 of the Investment Promotion and Facilitation Law, foreign investors are allowed to invest and purchase shares in an investment entity in Rwanda and receive the same treatment as Rwandan investors in terms of investment incentives and facilitation.
In this regard, Rwanda has neither statutory limits on foreign ownership or control nor any official economic or industrial strategy that discriminates against foreign investors. Local and foreign investors have the right to own and establish business enterprises in all forms of remunerative activity.