In 2013, the Rwandan government and Korean Telecom (KT) entered into a 25-year agreement to establish a 4G wholesale network in the country. As part of the partnership, the Rwandan government acquired a 49% stake in KT Rwanda networks Ltd (KTRN), with the remaining 51% owned by Korean Telecom.

Law No. 18/2010 establishes a safe harbour regime for intermediaries for copyright infringements. According to Art. 8, intermediaries and telecommunications network service providers are absolved of liability for the contents of documents or electronic messages transmitted through their networks by an individual. This liability applies to the creation, publication, and dissemination of electronic messages on the network and the use of such electronic messages in contravention of the law.
Furthermore, under Art. 10 of the same law, telecommunications operators and intermediaries are not liable for providing access to information, transmission or its retention as long as they do not initiate the transmission of the information or select the addressee and cannot modify the electronic communication. Under Art. 11, an intermediary or a certification authority shall not be liable for the automatic, intermediate, and temporary storage of that electronic record, in case the intention of such storage of electronic record is its onward transmission to other recipients who requested for it.
Additionally, under Art. 12, an intermediary that provides a service comprising the storage of electronic messages shall not be liable for damages arising from information stored if it is not aware that the information or the activity relating to the information infringes any person. Under Art. 13, an intermediary shall not be liable for damages incurred when it links its services with other websites containing electronic messages or activities that do not fulfil legal requirements. Arts. 188-192 of the Law Governing Information Communication and Technologies outlines the limits to liability to electronic service and network providers, limits of caching, hosting, and relating to information local tools.

It is reported that Rwanda does not mandate functional separation for operators with significant market power (SMP) in the telecom market. Yet, the country mandates accounting separation under Art. 103 of Law No. 24/2016 of 18/06/2016 Governing Information and Communication Technologies. This is also confirmed by Art. 18 and Section 15 of Annex II of Regulation No. 013/R/EC-ICT/RURA/2021 of 25/02/2021 Governing Licensing in Electronic Communication.

Law No. 18/2010 establishes a safe harbour regime for intermediaries beyond copyright infringements. According to Art. 8 of the law, intermediaries and telecommunications network service providers are absolved of liability for the contents of documents or electronic messages transmitted through their networks by an individual. This liability applies to the creation, publication, and dissemination of electronic messages on the network and the use of such electronic messages in contravention of the law.
Furthermore, under Art. 10 of the same law, telecommunications operators and intermediaries are not liable for providing access to information, transmission or its retention as long as they do not initiate the transmission of the information or select the addressee and cannot modify the electronic communication. Under Art. 11, an intermediary or a certification authority shall not be liable for the automatic, intermediate, and temporary storage of that electronic record, in case the intention of such storage of electronic record is its onward transmission to other recipients who requested for it.
Additionally, under Art. 12, an intermediary that provides a service comprising the storage of electronic messages shall not be liable for damages arising from information stored if it is not aware that the information or the activity relating to the information infringes any person. Under Art. 13, an intermediary shall not be liable for damages incurred when it links its services with other different websites containing electronic messages or activities that do not fulfil legal requirements. Arts. 188-192 of the Law Governing Information Communication and Technologies outlines the limits to liability to electronic service and network providers, limits of caching, hosting, and relating to information local tools.

Art. 29 of Annex 2 of Regulation No. 013/R/EC-ICT/RURA/2021 sets out the operational requirements that licensees must follow. This includes, but is not limited to, the purchase of equipment, construction, installation, and facility delivery. The Licensee must give priority to: (i) materials and products made in Rwanda; and (ii) service providers based in Rwanda, owned by Rwandan citizens or companies incorporated under Rwandan law with majority Rwandan ownership—provided this does not compromise safety, efficiency, or cost-effectiveness.
The Licensee is also required to prioritise the employment of Rwandan citizens across all operational phases, while maintaining safety, efficiency, and economy. In addition, it must provide training to Rwandan staff to support their advancement into managerial and technical roles. An annual report must be submitted to the Regulatory Authority detailing the strategies used to meet these obligations.

Rwanda has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

It is reported that the Rwanda Utilities Regulatory Authority (RURA), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Art. 16 of the "Regulations No. 001/R/TD-ICS/RURA/016 of 06/05/2016 Governing Telecom Network Security in Rwanda" mandates that subscriber information held by a telecommunication service provider or internet service provider—including voice, SMS, and call data records—must be processed, stored, and transmitted securely within the territory of Rwanda. The provision explicitly prohibits the transfer, storage, or processing of such subscriber information outside national borders.

Art. 15 of "Regulation No. 010/R/CR-CSI/RURA/020 of 29 May 2020 Governing Cybersecurity" stipulates that the networks, systems, and applications of licensed ICT companies must not be managed, hosted, accessed remotely, or located outside the territory of Rwanda, unless explicit authorisation is granted by the Regulatory Authority.

Art. 50 of Law No. 058/2021 stipulates that all personal data must be stored within the territory of Rwanda, unless prior authorisation for its transfer and storage has been granted by the National Cyber Security Authority (NCSA). In addition, Art. 48 provides that a data controller or data processor may disclose or transfer personal data to a third party located outside Rwanda only under the following conditions:
- authorisation has been obtained from the NCSA upon submission of evidence demonstrating the implementation of appropriate safeguards for the protection of personal data;
- the data subject has provided informed consent;
- the transfer is necessary for specific purposes as outlined in the Law.

Art. 111 of "Law No. 007/2021 of 05/02/2021 Governing Companies" mandates that companies maintain specific records at their registered office or at any other location within Rwanda, for a minimum period of ten years from the end of the financial year to which the records pertain. The company is required to retain the following documents: its incorporation instruments; the register of shares and debentures; the index of shareholders; accounting records along with supporting documentation; a register of directors' interests; minutes of all general meetings and shareholders’ resolutions; minutes of all meetings and resolutions of directors and board committees; certificates issued by directors in accordance with this Law; copies of all annual financial statements, auditors’ reports, and directors’ reports; the internal register of beneficial owners; and copies of all written communications distributed to shareholders or to all holders of a particular class of shares, including annual reports.
Law No. 007/2021 repealed the law of the same title enacted in 2018, which contained a comparable provision to the one referenced above, albeit under Art. 114.

Art. 17 of the "Ministerial Instructions No. 001/MINICT/2012 of 12/03/2012 Related to the Procurement of Information and Communications Technology Goods and Services by Rwanda Public Institutions" stipulates that all government information technology systems and applications which process, store, or provide access to critical government data and information must be hosted within the National Data Centre (NDC). In addition, Art. 18 provides that, in instances where government institutions host applications in their own data centres or server rooms, they are required to obtain disaster recovery (backup) services from the NDC.

Rwanda has not joined any free trade agreement committing to open transfers of cross-border data flows.

Law No. 058/2021 provides a comprehensive regime of data protection in Rwanda. The Law introduces principles related to lawfulness, fairness and transparency, purpose limitation and accuracy, and obligations related to data subject rights, registration as a data controller or data processor, pseudonymisation, sensitive data, data transfers, designation of a data protection officer, Data Protection Impact Assessments, and data breach notifications.

Art. 18 of the Regulation Governing Licensing of Multimedia Services Provision requires multimedia services to ensure that the recordings are kept for 90 calendar days in case the Regulatory Authority requests a copy of any recording. Multimedia services are defined as "media services such as data or text, visual image, audio, audio-visual, offered to the end users through an electronic device including but not limited to online newspaper, Internet radio, Internet TV, audio and VoD, IPTV and mobile TV".