BurundiLaw No. 1/03 of March 10, 2026 on the Protection of Personal Data
Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Self
What it requires
- Process the personal data of persons in Burundi only on a lawful basis under Article 8 of Loi n°1/03 (consent, contract, legal obligation, vital interests, a public-interest task or legitimate interests), and only for specified, explicit and legitimate purposes.
- Choose a processor that gives sufficient guarantees that it can meet the obligations in Loi n°1/03, bind it by a written contract under which it acts only on your instructions, and let it engage another processor only with your prior written authorization (Articles 11 to 13).
- Keep processing confidential, let only persons acting under your authority and on your instructions process the data after they sign a written undertaking to respect the law, and take the measures Article 44 lists to protect the integrity and confidentiality of the data, such as limiting access to authorized persons, recording who accessed what data and when, and keeping backups.
- A controller or processor not established in Burundi that processes data through means located there names a representative in Burundi, unless its processing is occasional.
- A major controller registers with the data protection body within six months, keeps a register of its processing, appoints a data protection officer and carries out an impact assessment before processing likely to present a high risk.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Has the decree that Article 42 of Loi n°1/03 provides for been issued to fix the missions, composition, organization and operation of the Agence de protection des données à caractère personnel, so that a developer knows which body receives the Article 45 breach notifications?
What it makes you log
Who may demand the log
Counterparty
What the log must hold
Event time, Actor identity, Access record
Logging duty
A controller must take measures that let it be verified and established afterwards who had access to the information system, which data were read or entered, at what time and by which person, and that cannot be done without an access record. The law names no log, format, owner, period or recipient. Article 36 also has a major controller keep a register of its processing, which describes processing and is not an event log. Article 13 has a processor give the controller the information needed to show compliance and allow audits, including inspections. Article 42 has the Agence monitor processing, with no stated power to demand records. The law has no recital stating what the record is for. The article was read from the OCR text of the official scan. Article 2 reaches a controller or processor using processing means located in Burundi, a means test the hook vocabulary has no value for, so no territorial hook is listed.
- Kind
- Implicit
- As of
- Provision
- Article 44, point 3
- Trigger
- personal_data_processing
What this law does
Burundi's comprehensive personal-data statute is Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (on the protection of personal data). The President of the Republic promulgated it at Gitega on , and under Article 55 it entered into force on the day of its promulgation. The telecommunications regulator ARCT published the law on .
The law applies to any automated or non-automated processing of personal data by a natural person, the State, local authorities and legal persons under public or private law, and to processing by a controller or processor, established in Burundi or not, that uses processing means located in Burundi other than for transit; a controller or processor not established in Burundi names a representative there unless its processing is occasional.
It excludes only processing by a natural person for exclusively personal or household activities and temporary copies made in the technical transmission of data, and it contains no exclusion for publicly available personal data.
Processing must be lawful, fair and transparent, for specified, explicit and legitimate purposes, adequate, accurate, kept no longer than needed and secured, and it is lawful only on a listed basis: consent, contract, a legal obligation, vital interests, a public-interest task, or legitimate interests that the person's rights do not override, notably where the person is a child.
A controller must choose a processor that gives sufficient guarantees that it can meet the law's obligations and bind it by a written contract under which it acts only on the controller's instructions, and a processor may not engage another processor without the controller's prior written authorization (Articles 11 to 13).
Processing is confidential and may be carried out only by persons acting under the controller's authority and on its instructions who have signed a written undertaking to respect the law, and the controller must take the measures Article 44 lists to protect the integrity and confidentiality of the data, including limiting access to authorized persons, logging who accessed what data and when, and keeping backups (Articles 43 and 44).
A major controller, meaning an enterprise of more than 200 employees, a public authority or national public body, or a private legal person managing certain life-saving, legal-claim, patient-care or health-research data, must register with the protection body within six months, keep a register of its processing, appoint a data protection officer and carry out an impact assessment before high-risk processing.
Processing begun before the law took effect must comply within one year for the State, public bodies and bodies with a public-service mission, and within six months for anyone else, counted from the day the law took effect.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .