<b>Ethical Governance of Virtual Learning and Student Privacy in Foreign Cloud-Hosted Learning Environments in Rwanda: A Systematic Review</b>

Background: The recent development of cloud computing and Learning Management Systems has dramatically changed teaching and learning processes in higher education institutions throughout the world. This systematic review aims at synthesizing and critically evaluating existing evidence on ethical governance mechanisms and student privacy protections in foreign cloud-hosted learning environments in higher education, particularly in Rwanda.  Methods: Peer-reviewed literature published between 2005 and 2025 was systematically searched in relevant databases. Studies dealing with ethical governance, student privacy, cloud computing, Learning Management Systems, digital sovereignty, and higher education were considered in the current review. The systematic review covered studies involving higher education institutions, students, faculty members, institutional governance mechanisms, and foreign cloud-hosted learning platforms.  Results: A systematic review methodology was used to find, screen, appraise, and synthesize evidence in 38 articles. The systematic review was guided by the concepts of Digital Sovereignty Theory, Institutional Theory, and Technology-Organization-Environment (TOE) Framework. It was found that inadequate data center infrastructure, poor governance mechanisms at institutions, and low digital literacy of students and faculty members are the main barriers to the proper protection of students' data and compliance with Law No. 058/2021 on personal data and privacy in Rwanda. Furthermore, institutional pressures make universities adopt foreign cloud services in order to achieve legitimacy and efficiency, regardless of privacy and data sovereignty issues. However, the use of cloud computing technologies brings many advantages, such as accessibility, scalability, collaboration, and learning analytics.  Conclusion: In order to ensure strong ethical governance and data sovereignty in Rwanda, it is necessary to invest in local digital infrastructure, develop robust institutional governance frameworks, enforce data protection policies, perform regular Data Protection Impact Assessments, and build digital ethics and cybersecurity capacity.  Future research: Future research is required to explore the consequences of the dependence on foreign cloud hosting in higher education in Rwanda.