BurundiLaw No. 1/03 of March 10, 2026 on the Protection of Personal Data, personal data breach notification
Loi n°1/03 du 10 mars 2026, articles 45-46 (notification des violations de données)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- Notify the data protection body of a breach likely to risk people's rights and freedoms as soon as possible and at the latest within 48 hours of becoming aware of it, give the reasons if the notification is late, and describe the nature of the breach, its probable consequences and the measures you have taken to mitigate the damage.
- Notify the persons concerned of a breach likely to give rise to a high risk to their rights and freedoms within a maximum of 96 hours of becoming aware of it, describing in clear and simple terms the nature of the breach, its possible consequences, the measures you have taken and the measures they can take to protect themselves.
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 45 requires a controller to notify the data protection body of a breach of the obligations arising from processing that is likely to risk the rights and freedoms of the persons concerned as soon as possible and at the latest within 48 hours after becoming aware of it, with the reasons for the delay if the notification is late, describing the nature of the breach, its probable consequences and the measures the controller has taken to mitigate the damage.
Article 46 requires a controller to notify the persons concerned of a breach likely to give rise to a high risk to their rights and freedoms within a maximum of 96 hours after becoming aware of it, describing in clear and simple terms the nature of the breach, its possible consequences, the measures taken, and the measures the persons can take to protect themselves. Under Article 55 the law entered into force on the day of its promulgation, .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.