Privacy notice
home/ Privacy notice
Last updated on November 27, 2025
1. Introduction
Rwanda Social Security Board (“RSSB”, “we”,“our”, or “us”) is committed to protecting and respecting the privacy of our members and all other individuals whose personal data we process (“data subjects”).This Privacy Notice explains how we collect, use, disclose, store, and protect personal data in connection with the services we provide and through our website. It applies to all persons who use or interact with our services, platforms, or communication channels.
We recognize and respect the expectations of our members and other data subjects regarding the privacy and security of their personal information. Safeguarding your personal data, using it solely for legitimate purposes related to our services, and preventing any unauthorized access or misuse are among our highest priorities.
RSSB is committed to complying with the provisions of Law No. 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy in Rwanda.
2. Scope
This Privacy Notice applies to all individuals whose personal data is processed by the Rwanda Social Security Board (RSSB) in connection with its functions and services.
It covers all personal data processed through our digital platforms, physical offices, and communication channels, including but not limited to:
- RSSB members enrolled in pension, health insurance, maternity, and other social security schemes.
- Job applicants who apply for employment or internship opportunities with RSSB;
- Employees and contractors working with RSSB.
- Visitors to our website, offices, or online portals; and
- Suppliers, service providers, and other stakeholders who interact with RSSB in the course of business.
3. Personal Data We Collect
In the course of delivering our services and fulfilling our legal and administrative obligations, RSSB collects and processes various categories of personal data from members and other individuals who interact with us.
Depending on the nature of your relationship with RSSB, we may collect and process the following personal data:
- Identification data: full names, parents’ names, date of birth, gender, marital status, national identification number, passport number, pension number.
- Contact details: telephone number, email address, and home address.
- Employment data: employer’s name, employer’s address, employment history, and related records.
- Financial data: bank account details for the purpose of benefit payments, contributions, and refunds.
- Photographic data: passport-sized photographs or other identification images used for registration, verification, or service access.
- Dependants’ Information: RSSB may process information about your dependants, including your children, as necessary to manage, administer, and provide services under the Medical Scheme and the Community-Based Health Insurance (CBHI) program.
In some cases, we may also collect other information necessary to provide our statutory services or comply with legal obligations.
4. Legal Bases for Processing personal data
RSSB primarily relies on the following legal bases for processing personal data:
- Performance of a legal obligation: RSSB processes personal data to comply with its statutory obligations under Law No. 009/2021.
- Performance of a task carried out in the public interest: As a public institution, RSSB processes personal data to fulfill its public mission of managing social security and providing benefits to members and their dependents.
5. Purpose of processing personal data
We process personal data for the following purposes:
- Member registration and identification: to register members and their dependents in various social security schemes.
- Contribution management: to collect, record, and track contributions from employers, employees, and self-employed persons.
- Benefit administration: to assess eligibility, process claims, and pay benefits under pension, health insurance, maternity leave, occupational hazards schemes.
- Communication and support: to communicate with members, respond to inquiries, and provide information on benefits, statements, and services.
- Employment and human resource management: to manage recruitment, employment, payroll, and staff welfare within RSSB.
- Security and fraud prevention: to protect members’ accounts, detect and prevent fraud, and safeguard the integrity of social security systems.
6. Who we share your information with
In the course of providing our services and fulfilling our legal and operational obligations, RSSB may share your personal information with other public institutions, service providers, consultants, and external auditors. Such sharing is done strictly in accordance with the Data Protection and Privacy Law and only where it is lawful, necessary, and proportionate to the intended purpose.
7. Your rights with respect to information we hold about you as a controller
As a data subject, you have several rights under the Data Protection and Privacy Law of Rwanda with respect to the personal information that RSSB processes in its capacity as a data controller. These rights include:
Right to Access
You have the right to request access to the personal information RSSB holds about you. Upon request, we will provide you with a copy of your data within reasonable amount of time.
Right to Rectification
You have the right to request the correction or updating of any inaccurate or incomplete personal information held by RSSB.
Right to Erasure
You have the right to request the deletion of your personal information in specific circumstances. For example, where the information is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent was the lawful basis for processing). RSSB will assess the request in line with its legal obligations and provide the feedback within reasonable amount of time.
Right to Restriction of Processing
You may request that RSSB restrict the processing of your personal information in certain situations, such as when the accuracy of your data is contested.
Right to Data Portability
Where applicable, you have the right to receive your personal information in a structured, commonly used, and machine-readable format, and to request that this information be transferred to another controller.
Right to Object
You have the right to object to the processing of your personal information in certain circumstances, including where your information is used for direct marketing purposes.
8. Retention of your personal data
RSSB retains your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Notice, including the administration of social security benefits, compliance with regulatory requirements. In certain cases, we may retain your information for longer periods as required by the law.
If you wish to exercise any of your data subject rights, you may submit a request by contacting our Data Protection Officer (DPO): dpo@rssb.rw
9. Location of Your Personal Data and International Transfers
RSSB primarily stores your personal data within Rwanda, where our data centers are physically located. In certain circumstances, we may use cloud-based systems to support our operations. When such cloud systems are utilized, they are governed by the outsourcing regulation issued by the National Bank of Rwanda and comply with Articles 48 and 50 of the Rwanda Personal Data Protection Law. These measures ensure that any cross-border data processing is conducted lawfully and with appropriate safeguards to protect your privacy.
10. How secure is your information
At RSSB, we take data security very seriously. We have taken steps to implement appropriate organizational, technical & physical safeguards to prevent unauthorized access, use, modification, disclosure or destruction of the information you entrust to us.
11. Data Protection Officer
We have appointed a Data Protection Officer to oversee our management of your personal data in accordance with DPP law. If you have any questions or concerns about our data privacy practices with respect to your personal data, you can reach out to our Data Protection Officer by sending an email to: dpo@rssb.rw