Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, transfers of personal data abroad

Article 15 allows a controller to transfer personal data to a foreign State or an international organization only if that State or organization ensures a sufficient level of protection of privacy and of the fundamental freedoms and rights of the persons concerned, assessed in the light of the protective rules in force there, the security measures applied, and the characteristics of the processing and the nature, origin and destination of the data.

An order of the minister in charge of the digital economy lists the countries whose level of protection is considered sufficient, and a controller may transfer data to a country not on the list if the receiving organization adopts adequate safeguards approved by the personal data protection body in Burundi.

Article 16 lists the elements taken into account in assessing sufficiency: the rule of law, respect for human rights and fundamental freedoms and the relevant general and sectoral legislation, the existence and effective operation of independent supervisory authorities, and the international commitments the country has undertaken on personal data protection. Under Article 55 the law entered into force on the day of its promulgation, 10 March 2026.