Processes personal data, in Burundi

Loi n°1/10 du 16 mars 2022 portant prévention et répression de la cybercriminalité au Burundi, article 62 (données nominatives sensibles) · Read the law's page

• Do not put online, or keep in computerized memory, named data that reveal a person's origins, political or religious opinions, trade-union membership or morals without that person's express agreement, or you face two to five years of penal servitude and a fine of 5,000,000 to 10,000,000 Burundian francs (Article 62).
• Do not divert such information, notably when it is recorded, filed or transmitted, which carries the same penalties (Article 62).

Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel · Read the law's page

• Process the personal data of persons in Burundi only on a lawful basis under Article 8 of Loi n°1/03 (consent, contract, legal obligation, vital interests, a public-interest task or legitimate interests), and only for specified, explicit and legitimate purposes.
• Choose a processor that gives sufficient guarantees that it can meet the obligations in Loi n°1/03, bind it by a written contract under which it acts only on your instructions, and let it engage another processor only with your prior written authorization (Articles 11 to 13).
• Keep processing confidential, let only persons acting under your authority and on your instructions process the data after they sign a written undertaking to respect the law, and take the measures Article 44 lists to protect the integrity and confidentiality of the data, such as limiting access to authorized persons, recording who accessed what data and when, and keeping backups.
• A controller or processor not established in Burundi that processes data through means located there names a representative in Burundi, unless its processing is occasional.
• A major controller registers with the data protection body within six months, keeps a register of its processing, appoints a data protection officer and carries out an impact assessment before processing likely to present a high risk.

Loi n°1/03 du 10 mars 2026, articles 15-16 (transfert de données à l'étranger) · Read the law's page

• Transfer personal data to a foreign State or international organization only if it ensures a sufficient level of protection of privacy and of persons' fundamental rights and freedoms, assessed on the protective rules in force there, the security measures applied and the nature, purpose, origin and destination of the data.
• Where a country is not on the minister's list of countries with a sufficient level of protection, transfer data there only if the receiving organization adopts adequate safeguards approved by the personal data protection body in Burundi.

Loi n°1/03 du 10 mars 2026, articles 17-18 and 21-33 (droits des personnes concernées) · Read the law's page

• Give a person, at the time you collect personal data directly from them, your identity, the purposes, the recipients, the retention period, their rights, whether the answers are compulsory or optional, and any processing of the data with artificial intelligence for automated decision-making; where you did not collect the data from them, give the same information and the source within one month.
• Obtain the person's consent after informing them before you process their data further for a purpose other than the one for which it was collected.
• Stop using a person's data for prospecting, including commercial, charitable or political prospecting, when they object, without charge and without requiring a reason, and respect a person's objection to processing for legitimate reasons unless you show compelling legitimate grounds.
• Confirm to a person on request whether you process their data and give them access and a free copy, and tell each recipient of any erasure or rectification unless that is impossible or involves disproportionate effort.
• Erase personal data without delay where it is no longer needed, consent is withdrawn and was the only basis, or the processing was unlawful, and rectify inaccurate data without delay.
• Give a person their data in a structured, commonly used, machine-readable format and, where technically possible, transmit it directly to another controller within fifteen calendar days of the request.
• Answer requests for access, rectification, objection and erasure without delay and at the latest one month from receipt, and where you cannot meet that deadline warn the person and notify the data protection body.

Loi n°1/03 du 10 mars 2026, articles 26-27, 35, 42 and 47-51 (organe de protection et dispositions pénales) · Read the law's page

• Collect and process personal data fairly, lawfully and transparently and only for determined, explicit and legitimate purposes compatible with the original purposes (Article 48).
• Where a person disputes your refusal of an access request as abusive, accept the data protection body's ruling on whether it was abusive, and comply with any precautionary measure it takes to prevent the concealment or disappearance of information (Articles 26 and 27).
• Register as a major controller with the data protection body within six months of acquiring that status, failing which the body may suspend your activities and then bar you from processing personal data (Articles 34 and 35).

Loi n°1/03 du 10 mars 2026, articles 45-46 (notification des violations de données) · Read the law's page

• Notify the data protection body of a breach likely to risk people's rights and freedoms as soon as possible and at the latest within 48 hours of becoming aware of it, give the reasons if the notification is late, and describe the nature of the breach, its probable consequences and the measures you have taken to mitigate the damage.
• Notify the persons concerned of a breach likely to give rise to a high risk to their rights and freedoms within a maximum of 96 hours of becoming aware of it, describing in clear and simple terms the nature of the breach, its possible consequences, the measures you have taken and the measures they can take to protect themselves.

Loi n°1/03 du 10 mars 2026, articles 9-10 (données sensibles) · Read the law's page

• Do not process data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership or health, or biometric data used to identify a person selectively, unless an Article 10 exception applies, such as the person's express consent.
• Use sensitive data processed under an Article 10 exception only for the purposes for which they were collected or compatible ones, and apply additional safeguards such as encryption, access controls, secure storage environments and regular security audits.