BurundiLaw No. 1/03 of March 10, 2026 on the Protection of Personal Data, the Agence de protection des données à caractère personnel and penalties
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
As of .
What it requires
- Collect and process personal data fairly, lawfully and transparently and only for determined, explicit and legitimate purposes compatible with the original purposes (Article 48).
- Where a person disputes your refusal of an access request as abusive, accept the data protection body's ruling on whether it was abusive, and comply with any precautionary measure it takes to prevent the concealment or disappearance of information (Articles 26 and 27).
- Register as a major controller with the data protection body within six months of acquiring that status, failing which the body may suspend your activities and then bar you from processing personal data (Articles 34 and 35).
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 42 creates the Agence de protection des données à caractère personnel to oversee application of the law and to monitor processing, and provides that a decree sets the agency's missions, composition, organization and operation.
Article 26 lets a person who believes a controller wrongly treated the exercise of the right of access as abusive refer the question to the agency, whose decision may be challenged in the courts, and Article 27 lets the person ask the agency for precautionary measures where information may be concealed or disappear.
Article 35 lets the agency, after an unheeded written warning to a major controller to register within six months, suspend that controller's activities for up to three months, and then bar it permanently from collecting and processing personal data.
Article 47 punishes a deliberate breach of personal data by a natural person with three months to one year of penal servitude and a fine of 50,000 to 500,000 Burundian francs, or one of them, and a private legal person with a fine of 1 million to 20 million francs, with a suspension of activities of up to six months for a major controller on repeat.
Article 48 punishes unfair, unlawful or non-transparent collection or processing, for purposes that are undetermined, not explicit, illegitimate or incompatible with the original purposes, with six months to five years and a fine of 500,000 to 10 million francs, or one of them, for a natural person and a fine of 5 million to 20 million francs, doubled for a major controller, for a private legal person.
Article 49 punishes a natural person who without legitimate reason opposes processing for archiving in the public interest, scientific or historical research or statistical purposes. Article 50 punishes processing the Article 9 sensitive data outside the Article 10 exceptions with a fine of 500,000 to 5 million francs, and Article 51 preserves the criminal provisions of other laws, notably the cybercrime law and the Penal Code. Under Article 55 the law entered into force on the day of its promulgation, .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.