Burundi

Article 45 requires a controller to notify the data protection body of a breach of the obligations arising from processing that is likely to risk the rights and freedoms of the persons concerned as soon as possible and at the latest within 48 hours after becoming aware of it, with the reasons for the delay if the notification is late, describing the nature of the breach, its probable consequences and the measures the controller has taken to mitigate the damage.

Article 46 requires a controller to notify the persons concerned of a breach likely to give rise to a high risk to their rights and freedoms within a maximum of 96 hours after becoming aware of it, describing in clear and simple terms the nature of the breach, its possible consequences, the measures taken, and the measures the persons can take to protect themselves. Under Article 55 the law entered into force on the day of its promulgation, 10 March 2026.

Burundi's comprehensive personal-data statute is Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel (on the protection of personal data). The President of the Republic promulgated it at Gitega on 10 March 2026, and under Article 55 it entered into force on the day of its promulgation. The telecommunications regulator ARCT published the law on 18 March 2026.

The law applies to any automated or non-automated processing of personal data by a natural person, the State, local authorities and legal persons under public or private law, and to processing by a controller or processor, established in Burundi or not, that uses processing means located in Burundi other than for transit; a controller or processor not established in Burundi names a representative there unless its processing is occasional.

It excludes only processing by a natural person for exclusively personal or household activities and temporary copies made in the technical transmission of data, and it contains no exclusion for publicly available personal data.

Processing must be lawful, fair and transparent, for specified, explicit and legitimate purposes, adequate, accurate, kept no longer than needed and secured, and it is lawful only on a listed basis: consent, contract, a legal obligation, vital interests, a public-interest task, or legitimate interests that the person's rights do not override, notably where the person is a child.

A controller must choose a processor that gives sufficient guarantees that it can meet the law's obligations and bind it by a written contract under which it acts only on the controller's instructions, and a processor may not engage another processor without the controller's prior written authorization (Articles 11 to 13).

Processing is confidential and may be carried out only by persons acting under the controller's authority and on its instructions who have signed a written undertaking to respect the law, and the controller must take the measures Article 44 lists to protect the integrity and confidentiality of the data, including limiting access to authorized persons, logging who accessed what data and when, and keeping backups (Articles 43 and 44).

A major controller, meaning an enterprise of more than 200 employees, a public authority or national public body, or a private legal person managing certain life-saving, legal-claim, patient-care or health-research data, must register with the protection body within six months, keep a register of its processing, appoint a data protection officer and carry out an impact assessment before high-risk processing.

Processing begun before the law took effect must comply within one year for the State, public bodies and bodies with a public-service mission, and within six months for anyone else, counted from the day the law took effect.

Article 15 allows a controller to transfer personal data to a foreign State or an international organization only if that State or organization ensures a sufficient level of protection of privacy and of the fundamental freedoms and rights of the persons concerned, assessed in the light of the protective rules in force there, the security measures applied, and the characteristics of the processing and the nature, origin and destination of the data.

An order of the minister in charge of the digital economy lists the countries whose level of protection is considered sufficient, and a controller may transfer data to a country not on the list if the receiving organization adopts adequate safeguards approved by the personal data protection body in Burundi.

Article 16 lists the elements taken into account in assessing sufficiency: the rule of law, respect for human rights and fundamental freedoms and the relevant general and sectoral legislation, the existence and effective operation of independent supervisory authorities, and the international commitments the country has undertaken on personal data protection. Under Article 55 the law entered into force on the day of its promulgation, 10 March 2026.

Article 19 requires a controller to tell a person that a decision with legal effects or significant effects on the person is automated and to explain the underlying logic in clear and simple terms, and, where the processing merely assists a human decision, to describe the human decision-maker's own contribution, in particular the methods and criteria used.

Article 20 permits an automated decision with legal effects or significant effects only where an act of legislation or regulation provides for it with appropriate safeguards, the person consents, or it is strictly necessary to conclude or perform a contract between the person and the controller.

Where an automated decision is permitted, Article 20 requires individual reasons, and it gives the person the right to have the decision reformulated: the person may submit written observations and a human takes a new reasoned decision that entirely replaces the first. Under Article 55 the law entered into force on the day of its promulgation, 10 March 2026.

Article 17 requires a controller that collects personal data directly from the person concerned to tell the person at the time of collection the controller's identity, the purposes, the recipients, the retention period, the existence and exercise of the person's rights, whether the answers are compulsory or optional, and any processing of the data with artificial intelligence for automated decision-making, and Article 18 requires prior information and consent before further processing for another purpose.

Article 21 gives a controller that did not collect the data from the person at most one month to give that information and the source of the data. Article 22 gives the person a right to object, for legitimate reasons, to processing, and Article 23 a right to object without charge and without giving a reason to use of the data for prospecting, notably commercial, charitable or political.

Articles 24 to 27 give a right to confirmation that data are processed and to access, with a free copy, and provide for referral to the data protection body where the exercise of access is called abusive and for precautionary measures against concealment or disappearance of information.

Article 28 gives a right to erasure, and the controller must tell each recipient of an erasure; Article 29 gives a right to rectification; Article 31 gives a right to data portability, with a maximum of fifteen calendar days from receipt of the request for direct transmission between controllers.

Article 33 requires the controller to act on requests for access, rectification, objection and erasure without delay and at the latest one month from receipt, and to warn the person and notify the data protection body when it cannot meet that deadline. Under Article 55 the law entered into force on the day of its promulgation, 10 March 2026.

Article 42 creates the Agence de protection des données à caractère personnel to oversee application of the law and to monitor processing, and provides that a decree sets the agency's missions, composition, organization and operation.

Article 26 lets a person who believes a controller wrongly treated the exercise of the right of access as abusive refer the question to the agency, whose decision may be challenged in the courts, and Article 27 lets the person ask the agency for precautionary measures where information may be concealed or disappear.

Article 35 lets the agency, after an unheeded written warning to a major controller to register within six months, suspend that controller's activities for up to three months, and then bar it permanently from collecting and processing personal data.

Article 47 punishes a deliberate breach of personal data by a natural person with three months to one year of penal servitude and a fine of 50,000 to 500,000 Burundian francs, or one of them, and a private legal person with a fine of 1 million to 20 million francs, with a suspension of activities of up to six months for a major controller on repeat.

Article 48 punishes unfair, unlawful or non-transparent collection or processing, for purposes that are undetermined, not explicit, illegitimate or incompatible with the original purposes, with six months to five years and a fine of 500,000 to 10 million francs, or one of them, for a natural person and a fine of 5 million to 20 million francs, doubled for a major controller, for a private legal person.

Article 49 punishes a natural person who without legitimate reason opposes processing for archiving in the public interest, scientific or historical research or statistical purposes. Article 50 punishes processing the Article 9 sensitive data outside the Article 10 exceptions with a fine of 500,000 to 5 million francs, and Article 51 preserves the criminal provisions of other laws, notably the cybercrime law and the Penal Code. Under Article 55 the law entered into force on the day of its promulgation, 10 March 2026.

Article 9 prohibits processing personal data that reveal, directly or indirectly, racial or ethnic origin, political, philosophical or religious opinions or trade-union membership, data relating to health, and biometric data processed to identify a natural person selectively.

Article 10 lifts the prohibition, to the extent the purpose requires, for processing on the person's express consent unless a law bars lifting the prohibition even by consent, processing necessary to safeguard human life where the person cannot consent, processing by a non-profit association for its members, processing for legal claims, medical follow-up of patients in an emergency, and health research with the person's consent, and it lets the minister in charge of civil status add public-interest exceptions by order.

Article 10 also provides that sensitive data may be used only for the purposes for which they were collected or compatible ones and must have additional safeguards such as encryption, access controls, secure storage environments and regular security audits. Article 40 presumes a high risk, and so an impact assessment by a major controller, whenever processing rests on Article 9 data. Under Article 55 the law entered into force on the day of its promulgation, 10 March 2026.

Article 62 of Loi n°1/10 du 16 mars 2022 makes it an offense for anyone to put online, or keep in computerized memory, without the express agreement of the person concerned, nominative data that directly or indirectly reveal the person's origins, political or religious opinions, trade-union membership or morals. Article 62 punishes that offense with two to five years of penal servitude and a fine of 5 million to 10 million Burundian francs.

Article 62 applies the same penalties to anyone who diverts such information, notably when it is recorded, filed or transmitted. Under Article 70 the law entered into force on the day of its promulgation, 16 March 2022.

Burundi's dedicated cybercrime statute is Loi n°1/10 du 16 mars 2022 portant prévention et répression de la cybercriminalité au Burundi (on the prevention and repression of cybercriminality in Burundi), promulgated at Gitega on 16 March 2022. Under Article 70 it entered into force on the day of its promulgation. The statute covers cyber offenses committed in Burundi, or abroad where they produce effects in Burundi, and any offense whose proof requires electronic evidence (Article 1).

It defines unlawful access (accès illicite) as intentional access, without having the right, to all or part of an electronic communication network, information system or terminal equipment (Article 2).

Fraudulent access to a computer system carries six months to two years of penal servitude and a fine of 2 million to 5 million Burundian francs, or one of them (Article 16), and fraudulently remaining in a computer system carries one to three years and a fine of 10 million to 15 million francs, or one of them (Article 18).

Access without right and in breach of security measures to a network, information system or terminal, to obtain information connected with another system, carries two to five years and a fine of 15 million to 20 million francs (Article 19). Intentionally and without right reproducing, extracting or copying another person's computer data carries five to ten years and a fine of 10 million to 15 million francs, or one of them (Article 29).

Hindering a computer system's operation, including by saturating or attacking a network resource to bring it down, carries ten to fifteen years and a fine of 10 million to 30 million francs (Article 21).

Burundi's copyright statute treats a database as a protected compilation rather than through a separate sui generis database right. Article 26(1)(a)'s private-copy exception expressly excludes reproducing all or major parts of a database in digital format, meaning a database is a protected work whose substantial reproduction the rights holder can otherwise prevent; there is no separate sui generis database right of the EU kind.

Article 7 excludes official texts, daily news, and mere facts and data from copyright protection outright.

Article 26 also lets a person quote a lawfully published work, including newspaper articles and periodicals in the form of press summaries, and reproduce a current-events news article or broadcast subject to source attribution, unless publication was accompanied by an express reservation against such use; none of these exceptions is framed as a text-and-data-mining carve-out, and nothing in the Law addresses AI training specifically.

Article 3 requires every opérateur des réseaux (network operator) and fournisseur des services (service provider) to guarantee the security of the services it offers and to put in place the technical processes and means needed to fight cyber fraud. Article 2(11) defines a fournisseur des services as any natural or legal person providing one or more services to users of a telecommunication system.

Article 4 additionally requires the same bound parties to maintain an operational management center for their critical infrastructure on Burundian national territory. Article 4 also requires retaining connection and traffic data for a minimum of ten years. It requires installing mechanisms to monitor the operator's own network traffic data.

It requires installing a video-surveillance system in cybercafés. These three obligations read as data-retention, surveillance-capability, and physical-security duties rather than a security-posture requirement for a system or service, so this row flags only the Article 3 and Article 4(3) duties as its activity.

Article 14 imposes a fine of ten to thirty million Burundian francs on a service provider or network operator that fails to exercise the diligence and competence necessary to prevent the disclosure of computer data made available to a third party. No additional imprisonment attaches to Article 14, unlike most neighboring articles in the same chapter.

Article 7 excludes acts, legal decisions and administrative decisions and their official translations, daily news published, broadcast or communicated in public, and mere facts and data, from copyright protection outright: a bare fact, or the news of the day as such, is never a protected work under Burundian law, whichever outlet reports it first.

Article 26(1)(b) separately lets any person, once a work has been lawfully published, quote from it in another work, including quotations from newspaper articles and periodicals in the form of press summaries, provided the quotation is compatible with fair practice, does not exceed the extent justified by its purpose, and the source and the author's name are mentioned.

Article 26(2) lets a current economic, political or religious news article published in a newspaper or periodical, or a broadcast of the same character, be reproduced in the press or communicated to the public, subject to the source being clearly indicated, unless the article as published, or the work as broadcast, was itself accompanied by an express condition prohibiting such use, meaning the publisher can reserve the reproduction right in advance.

Neither exception is capped at a headline-length or short-extract threshold and neither is confined to the press industry; whether either reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a traditional press review or a broadcaster's current-events report, has not been tested in a reported Burundian decision.

Burundi has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.