BurundiLaw No. 1/03 of March 10, 2026 on the Protection of Personal Data, information, access and other rights of the person concerned
Loi n°1/03 du 10 mars 2026, articles 17-18 and 21-33 (droits des personnes concernées)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent
As of .
What it requires
- Give a person, at the time you collect personal data directly from them, your identity, the purposes, the recipients, the retention period, their rights, whether the answers are compulsory or optional, and any processing of the data with artificial intelligence for automated decision-making; where you did not collect the data from them, give the same information and the source within one month.
- Obtain the person's consent after informing them before you process their data further for a purpose other than the one for which it was collected.
- Stop using a person's data for prospecting, including commercial, charitable or political prospecting, when they object, without charge and without requiring a reason, and respect a person's objection to processing for legitimate reasons unless you show compelling legitimate grounds.
- Confirm to a person on request whether you process their data and give them access and a free copy, and tell each recipient of any erasure or rectification unless that is impossible or involves disproportionate effort.
- Erase personal data without delay where it is no longer needed, consent is withdrawn and was the only basis, or the processing was unlawful, and rectify inaccurate data without delay.
- Give a person their data in a structured, commonly used, machine-readable format and, where technically possible, transmit it directly to another controller within fifteen calendar days of the request.
- Answer requests for access, rectification, objection and erasure without delay and at the latest one month from receipt, and where you cannot meet that deadline warn the person and notify the data protection body.
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 17 requires a controller that collects personal data directly from the person concerned to tell the person at the time of collection the controller's identity, the purposes, the recipients, the retention period, the existence and exercise of the person's rights, whether the answers are compulsory or optional, and any processing of the data with artificial intelligence for automated decision-making, and Article 18 requires prior information and consent before further processing for another purpose.
Article 21 gives a controller that did not collect the data from the person at most one month to give that information and the source of the data. Article 22 gives the person a right to object, for legitimate reasons, to processing, and Article 23 a right to object without charge and without giving a reason to use of the data for prospecting, notably commercial, charitable or political.
Articles 24 to 27 give a right to confirmation that data are processed and to access, with a free copy, and provide for referral to the data protection body where the exercise of access is called abusive and for precautionary measures against concealment or disappearance of information.
Article 28 gives a right to erasure, and the controller must tell each recipient of an erasure; Article 29 gives a right to rectification; Article 31 gives a right to data portability, with a maximum of fifteen calendar days from receipt of the request for direct transmission between controllers.
Article 33 requires the controller to act on requests for access, rectification, objection and erasure without delay and at the latest one month from receipt, and to warn the person and notify the data protection body when it cannot meet that deadline. Under Article 55 the law entered into force on the day of its promulgation, .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.