BurundiLoi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds you only if you are an opérateur des réseaux (network operator) or fournisseur des services under Burundian law, defined at Art. 2(11) as any natural or legal person providing one or more services to users of a telecommunication system.
- Guarantee the security of the services you offer, and put in place the technical processes and means needed to fight cyber fraud.NIST CSF 2.0PR.IR-01
- Maintain an operational management center for your critical infrastructure on Burundian national territory.no control in the NIST CSF 2.0
- Exercise the diligence and competence necessary to prevent the disclosure of computer data you hold on behalf of a third party, or face a fine of 10,000,000 to 30,000,000 Burundian francs (BIF) under Article 14.NIST CSF 2.0PR.DS-01
- Article 4 also states three further common obligations this row does not flag as a security duty: retain connection and traffic data for at least ten years, install mechanisms to monitor your own network's data traffic, and, if you operate a cybercafé, install a video-surveillance system; these read as data-retention, surveillance-capability, and physical-security mandates rather than a duty over your systems' or services' own security posture.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 14's fine is imposed as an infraction under Chapitre III (offenses against the confidentiality, integrity and availability of data and systems); unlike most neighboring articles in the same chapter, it carries no additional servitude pénale (prison term).
Penalty structure
Article 14 sets a fine of ten to thirty million Burundian francs (BIF) for a service provider or network operator that fails to exercise the diligence and competence necessary to prevent disclosure of computer data made available to a third party; no additional imprisonment attaches to this article.
- Rule
- Fixed only
- As of
- Minimum
- 10,000,000
- Currency
- BIF
- Fixed cap
- 30,000,000
Who enforces it
Enforcement body
No cybersecurity or telecommunications regulator is named in the Act as holding supervisory or enforcement authority over these provisions. Chapitre VII's criminal-procedure articles (Arts. 65-68) route investigation through 'l'autorité compétente' and the Officier du Ministère Public, and Article 14 is prosecuted as an ordinary criminal offense through the courts rather than through a dedicated regulator.
Settledness
No implementing decree or ARCT regulation elaborating Article 3's or Article 4's technical requirements was located in the sources reviewed here.
- As of
- Open questions
- Has any decree or ARCT regulation specified the technical processes and means Article 3 requires a network operator or service provider to put in place to guarantee service security and fight cyber fraud?
- Does Article 14's fine attach only to the disclosure-diligence duty stated there, or does an unlocated implementing text also set a penalty for the retention, traffic-monitoring, or cybercafé video-surveillance duties Article 4 states separately?
What this law does
Article 3 requires every opérateur des réseaux (network operator) and fournisseur des services (service provider) to guarantee the security of the services it offers and to put in place the technical processes and means needed to fight cyber fraud. Article 2(11) defines a fournisseur des services as any natural or legal person providing one or more services to users of a telecommunication system.
Article 4 additionally requires the same bound parties to maintain an operational management center for their critical infrastructure on Burundian national territory. Article 4 also requires retaining connection and traffic data for a minimum of ten years. It requires installing mechanisms to monitor the operator's own network traffic data.
It requires installing a video-surveillance system in cybercafés. These three obligations read as data-retention, surveillance-capability, and physical-security duties rather than a security-posture requirement for a system or service, so this row flags only the Article 3 and Article 4(3) duties as its activity.
Article 14 imposes a fine of ten to thirty million Burundian francs on a service provider or network operator that fails to exercise the diligence and competence necessary to prevent the disclosure of computer data made available to a third party. No additional imprisonment attaches to Article 14, unlike most neighboring articles in the same chapter.
When LexLint raises it
When your app profile says your app provides telecom services.
Back to the example · Lint your app
Page updated .