Rwanda’s incoming digital IDs: What you need to know
A new law governing the registration of the population in the national single digital identity system was published in the official gazette on June 15.
The Rwandan government has signaled that existing plastic identity cards will no longer be in use in three years as authorities move to create and operationalize a National Single Digital Identity System (SDID) for all the persons domiciled in the country and citizens living abroad.
The changes will have implications on modalities of delivering different services in the country, and the use of other cards in physical forms such as driving licences and health insurance will be affected.
New legislation
A new law governing the registration of the population in the national single digital identity system was published in the official gazette on June 15.
The legislation gives concerned organs until June 15, 2027 to completely phase out registration of the population and issuance of the current plastic national identity cards.
Rwandans will have to physically be at designated centres in the country or abroad to submit their biographic data, and biometric data including a front-facing photograph, fingerprints and iris scan.
The above, in addition to the domicile details, are required prior to being issued with SDID number or SDID number token in print or electronic form as proof of identity, according to the law.
The SDID number refers to a randomly generated, unique, and permanent identification number which serves as an identifier for the person to whom it is assigned.
Per the law, a person registered in the SDID system, a repository that randomly generates SDID number and SDID number token, must possess a SDID card.
He is is, however, not required to carry the SDID card.
The latter refers to a physical or digital credential issued to a person registered under SDID registry.
Service delivery
The changes are in line with authorities’ drive to promote quality service delivery in public, private and Civil Society Organizations.
The treasury, recently indicated that allocations in the new budget will prioritise upgrade of e-Citizen complaint system to enhance its capacity and increase digitization of services, on top of scaling up digital identification and authentication.
Government gradually digitized public services, and has moved to enact a data protection law amid growing concerns that digitization across sectors could be happening without proper personal data protection safeguards.
Firms in the country have until October this year to comply with the new law that requires them to, among other things, seek consent before collecting personal data and constantly report data breach incidents.
Licensed data controllers and processors are also required to store data in Rwanda. Storage abroad must be subject to authorization.
The new law was enacted in October 2021, but its implementation was delayed by two years to allow firms to prepare.
While it’s unclear what the extent of data breach threats locally, industry players say many sub-sectors of the economy such as banking, insurance, telcom and betting have attracted several foreign firms which, if unchecked, could transfer users’ personal data to their subsidiaries abroad.
