BurundiLaw No. 1/03 of March 10, 2026 on the Protection of Personal Data, sensitive data and biometric identification
Loi n°1/03 du 10 mars 2026, articles 9-10 (données sensibles)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Security
As of .
What it requires
- Do not process data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership or health, or biometric data used to identify a person selectively, unless an Article 10 exception applies, such as the person's express consent.
- Use sensitive data processed under an Article 10 exception only for the purposes for which they were collected or compatible ones, and apply additional safeguards such as encryption, access controls, secure storage environments and regular security audits.
These lines are LexLint's reading of the law's text, as of .
What this law does
Article 9 prohibits processing personal data that reveal, directly or indirectly, racial or ethnic origin, political, philosophical or religious opinions or trade-union membership, data relating to health, and biometric data processed to identify a natural person selectively.
Article 10 lifts the prohibition, to the extent the purpose requires, for processing on the person's express consent unless a law bars lifting the prohibition even by consent, processing necessary to safeguard human life where the person cannot consent, processing by a non-profit association for its members, processing for legal claims, medical follow-up of patients in an emergency, and health research with the person's consent, and it lets the minister in charge of civil status add public-interest exceptions by order.
Article 10 also provides that sensitive data may be used only for the purposes for which they were collected or compatible ones and must have additional safeguards such as encryption, access controls, secure storage environments and regular security audits. Article 40 presumes a high risk, and so an impact assessment by a major controller, whenever processing rests on Article 9 data. Under Article 55 the law entered into force on the day of its promulgation, .
When LexLint raises it
When your app profile says your app crawls the web, trains models, processes biometric data, processes voice recordings or handles health records.