5.16 Back-up copies The registries shall ensure that copies are kept of all registered data, for at least five years. 5.17 Data privacy The privacy of personal information regarding domain name owners shall be safeguarded in accordance with national law. 5.18 Dispute resolution service (1) The registry shall set up a dispute resolution service and dispute resolution procedures. (2) The registry shall determine its organization and procedures, which must be fair, rapid and appropriate. The rules for resolving disputes shall be based on accepted best practice (UDRP: Uniform Domain Names Resolution Policy). (3) The approval of the regulator is required for the organizational structure, the rules governing dispute resolution, the rules of procedure and the appointment of panel members. 5.19 Complaints procedures (1) The registry shall establish a domain complaints board comprising at least three members. (2) The complaints boards may handle complaints: a) against decisions passed by the registry on applications for assignment of a domain name; b) against decisions passed by the registry under paragraph (2) of guideline 5.11 here above; c) from registries that a name has been registered in contravention of a personal affirmation; d) from a third party, under paragraph (1) c) of the said guideline 5.11; e) from a public agency, under paragraph (1) d) of the said guideline 5.11; and f) from the national regulator claiming that registration of the domain name is contrary to the rules. (3) Complaints under subsection e) above must be filed no later than three months after the domain name is registered. (4) Opinions returned by the complaints board on complaints under subsection a) above, shall be binding for the registry. Opinions returned by the board on complaints under subsections b) through f) shall be advisory. (5) The domain complaints board may be financed through an addition to the charge for registering the domain name and a charge payable by the complainant. Rwanda Utilities Regulatory Agency 13