What Is Law No. 1/03 of 10 March 2026 on the Protection of Personal Data?
Burundi has an enacted general data-protection statute: Law No. 1/03 of 10 March 2026 on the Protection of Personal Data. Its enactment is recorded by official ARCT and National Assembly materials, and the law enters into force on promulgation. Earlier official statements that Burundi lacked a data-protection framework are historical. The law applies to automated and non-automated processing by public and private bodies and natural persons. It also covers controllers and processors using processing means located in Burundi, except means used solely for transit. Personal or domestic processing and temporary technical copies used solely for transmission or access provision are excluded. A statutory Agency for the Protection of Personal Data is created, but the latest official implementation evidence located is still a project decree concerning the Agency’s organisation and functioning. No official operational complaint portal, appointment notice, or functioning Agency procedure was located.
At a glance
- Full name
- Law No. 1/03 of 10 March 2026 on the Protection of Personal Data
- Short code
- Law No. 1/03 of 2026
- Jurisdiction
- Burundi
- Enacted
- 2026
- Last major update
- Enacted and promulgated 10 March 2026; no official amendment instrument was located through 28 August 2026, and Agency implementation remained evidenced by a project decree
- Regulator
- Agency for the Protection of Personal Data
- Private right of action
- Limited
- Statutory citation
- Law No. 1/03 of 10 March 2026 on the Protection of Personal Data
Scope, who Law No. 1/03 of 2026 covers
Protected data
Data subject rights
Right to notice at collection and, where data were obtained indirectly, notice within one month including the data source
Right to confirmation of processing and access to personal data
Right to receive a first access copy free of charge, generally in electronic format where requested electronically
Right to rectification and completion of inaccurate or incomplete data
Right to erasure where data are no longer necessary, consent is withdrawn for consent-based processing, or processing is unlawful
Unconditional and free right to object to direct marketing, including commercial, charitable, or political prospecting
Right to portability of data provided by the subject in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract
Protection against solely automated decisions producing legal or similarly significant effects
Right to access medical data through a doctor designated by the subject
Right to indirect access through the Agency for state-security, defence, or public-security processing
Notable features
Burundi’s 10 March 2026 framework includes access, erasure, portability, direct-marketing, and automated-decision provisions. Its principal implementation gap is institutional: no operational Agency complaint portal, appointment notice, or functioning Agency procedure was located.
Enforcement & penalties
Regulator: Agency for the Protection of Personal Data
Penalties: Official legislative text provides imprisonment of 6 months to 5 years and/or BIF 2,000,000–15,000,000 for unlawful breach-related processing by a natural person, with BIF 20,000,000–50,000,000 for a private legal person. Unfair, unlawful, non-transparent, or incompatible-purpose collection or processing may carry 6 months to 5 years and/or BIF 500,000–10,000,000 for a natural person, or BIF 5,000,000–20,000,000 for a private legal person. Opposition to processing for public-interest archival, scientific, historical, or statistical purposes may carry 1–10 years and/or BIF 500,000–10,000,000. Unlawful processing of sensitive or biometric-identification data carries BIF 1,000,000–5,000,000.
Private right of action: Agency decisions are stated to be challengeable before the courts. No general private compensation route or standalone civil-action right was located in the report.
Relevance to data brokers
No official Burundi data-broker-specific registration, complaint, opt-out, deletion portal, or designated consumer route was located. Narrow commercial-registry and financial-distress correction, suppression, and creditor-radiation mechanisms exist, but they are not general personal-data deletion or data-broker opt-out routes.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Does Burundi have a data-protection law?+
Yes. Law No. 1/03 of 10 March 2026 on the Protection of Personal Data is enacted and enters into force on promulgation. However, no operational Agency complaint portal, appointment notice, or functioning Agency procedure was located.
What rights does Burundi’s 2026 law provide?+
The law provides information, access, rectification, completion, erasure, objection, direct-marketing objection, portability, automated-decision safeguards, medical-data access through a designated doctor, and indirect access through the Agency for specified security-related processing.
Does Burundi have a data-broker deletion route?+
No official Burundi data-broker-specific registration, complaint, opt-out, deletion portal, or designated consumer route was located.
Official sources & citations
Other international privacy regimes
Law No. 1/03 of 2026 sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: