Art. 111 of "Law No. 007/2021 of 05/02/2021 Governing Companies" mandates that companies maintain specific records at their registered office or at any other location within Rwanda, for a minimum period of ten years from the end of the financial year to which the records pertain. The company is required to retain the following documents: its incorporation instruments; the register of shares and debentures; the index of shareholders; accounting records along with supporting documentation; a register of directors' interests; minutes of all general meetings and shareholders’ resolutions; minutes of all meetings and resolutions of directors and board committees; certificates issued by directors in accordance with this Law; copies of all annual financial statements, auditors’ reports, and directors’ reports; the internal register of beneficial owners; and copies of all written communications distributed to shareholders or to all holders of a particular class of shares, including annual reports.
Law No. 007/2021 repealed the law of the same title enacted in 2018, which contained a comparable provision to the one referenced above, albeit under Art. 114.

Art. 17 of the "Ministerial Instructions No. 001/MINICT/2012 of 12/03/2012 Related to the Procurement of Information and Communications Technology Goods and Services by Rwanda Public Institutions" stipulates that all government information technology systems and applications which process, store, or provide access to critical government data and information must be hosted within the National Data Centre (NDC). In addition, Art. 18 provides that, in instances where government institutions host applications in their own data centres or server rooms, they are required to obtain disaster recovery (backup) services from the NDC.

Rwanda has not joined any free trade agreement committing to open transfers of cross-border data flows.

Law No. 058/2021 provides a comprehensive regime of data protection in Rwanda. The Law introduces principles related to lawfulness, fairness and transparency, purpose limitation and accuracy, and obligations related to data subject rights, registration as a data controller or data processor, pseudonymisation, sensitive data, data transfers, designation of a data protection officer, Data Protection Impact Assessments, and data breach notifications.

Art. 18 of the Regulation Governing Licensing of Multimedia Services Provision requires multimedia services to ensure that the recordings are kept for 90 calendar days in case the Regulatory Authority requests a copy of any recording. Multimedia services are defined as "media services such as data or text, visual image, audio, audio-visual, offered to the end users through an electronic device including but not limited to online newspaper, Internet radio, Internet TV, audio and VoD, IPTV and mobile TV".

Art. 40 of the Law relating to the Protection of Personal Data and Privacy requires companies to appoint a Data Protection Officer (DPO). The data controller and the data processor are required to designate a data protection officer if the processing of personal data is carried out by a public or private corporate body or a legal entity. The core activities of the data controller or the data processor consist of personal data processing operations which, by virtue of their nature, their scope or their purposes, require regular and systematic monitoring of data subjects on a large scale.
Additionally, under Art. 38 (3), the data controller and the data processor are to carry out personal Data Protection Impact Assessments (DPIA) in compliance with the principles of the processing of personal data. The DPIA is to be carried out in cases where the processing of personal data is likely to result in a high risk to the rights and freedoms of a natural person.

Art. 3 of the Interception of Communications Law provides for unrestricted access to personal data if it is done in the interest of national security. Furthermore, the Interception of Communications Law provides that an interception warrant must be issued by a national prosecutor designated by the Minister of Justice. Under Art. 7, communications service providers are required to ensure that their systems have the technical capability to intercept communications on demand. Security officials also have the power to “intercept communications using equipment that is not facilitated by communication service providers”, which effectively allows the authorities to hack into a telecommunications network without a provider’s knowledge or assistance.

Rwanda is not a signatory of the 1996 World Trade Organization (WTO) Information Technology Agreement (ITA) nor the 2015 expansion (ITA II).

According to Art. 73 of Law No. 031/2022, the procuring entity, through competition, gives preference to:
- Supplies or goods produced or manufactured in Rwanda;
- Consultancy and non-consultancy service providers registered as a domestic legal entity when procuring consultancy and non-consultancy services;
- A legal entity registered in Rwanda as a domestic legal entity when procuring for works; and
- An individual consultant operating in consultancy services.
Ministerial Order No. 001/23/10/TC determines the modalities for applying these preferences. According to Art. 62 of the Order, through competition, all procuring entities shall give exclusive preference to:
(i) Goods or supplies manufactured in Rwanda, when procuring goods or supplies with a value not exceeding FRW 200,000,000 (approx. USD 160,000); and
(ii) Service providers registered in Rwanda as domestic companies, for at least six months, when procuring non-consultancy services and consultancy services with a value not exceeding FRW 100,000,000 (approx. USD 80,000).

According to Art. 73 of Law No. 031/2022, the procuring entity, through competition, gives preference to:
- Supplies or goods produced or manufactured in Rwanda;
- Consultancy and non-consultancy service providers registered as a domestic legal entity when procuring consultancy and non-consultancy services;
- A legal entity registered in Rwanda as a domestic legal entity when procuring for works; and
- An individual consultant operating in consultancy services.
Ministerial Order No. 001/23/10/TC determines the modalities for applying these preferences. According to Art. 63 of the Order, price preference is used during the financial evaluation stage of bids for international or national tenders, in accordance with the following rules:
(i) A 15% local preference is granted to locally manufactured goods or supplies. When a bid includes both locally manufactured and imported goods or supplies, the preference applies only to the locally manufactured portion.
(ii) A 15% local preference is granted to companies registered in Rwanda as domestic companies for at least six months, when procuring consultancy and non-consultancy services.
Additionally, local preference is granted to joint ventures between a domestic and a foreign company, provided the domestic company fulfils at least 30% of the technical and financial requirements. However, this preference does not apply to tenders for consultancy services.

Rwanda is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

There is no restriction on foreign ownership. According to Art. 9 of the Investment Promotion and Facilitation Law, foreign investors are allowed to invest and purchase shares in an investment entity in Rwanda and receive the same treatment as Rwandan investors in terms of investment incentives and facilitation.
In this regard, Rwanda has neither statutory limits on foreign ownership or control nor any official economic or industrial strategy that discriminates against foreign investors. Local and foreign investors have the right to own and establish business enterprises in all forms of remunerative activity.

According to Art. 6 of Law No. 007/2021 of 05/02/2021 Governing Companies, a company must have at least one director who resides in Rwanda.

Under Art. 17 of the Law on Investment Promotion and Facilitation, commercial entities seeking to invest in Rwanda are required to submit an investment registry application to the Investment Board. The application must include several key documents, including a completed registration form, a certificate of incorporation, and a comprehensive business plan. The business plan must detail the project’s name, an action plan, the projected commencement date, the sourcing of raw materials, the financing or assets to be obtained from abroad, a market survey, plans for technology and knowledge transfer, and five-year income projections. Additionally, the application must include an environmental impact assessment certificate, projected employment numbers and categories, proof of payment of a non-refundable registration fee, and a license from the relevant business sector in which the investor intends to operate. The Investment Board reviews the application, and if any documents are missing, the application will be rejected, with written reasons for rejection provided within two working days. If the application is complete and meets the necessary requirements, the Board will issue an "investment certificate," which is valid for five years.