Burundi: technology regulation at a glance

Framework: Banque de la République du Burundi (BRB) prohibition on all virtual currency transactions, announced September 2019; no enabling legislation or licensing regime exists

The Bank of the Republic of Burundi (BRB) issued a blanket prohibition on all cryptocurrency trading and remittances in September 2019, stating that virtual currencies have no legal tender status in Burundi and that no financial institution is authorised to offer payment or remittance services using them. The central bank warned that 'strong measures' would be taken against violators. As of mid-2026, no official legislation or BRB circular has reversed or formally replaced this prohibition; no licensing, custody, stablecoin, or token-offering framework exists.

Framework: Stratégie Nationale de l'Intelligence Artificielle 2026-2030 (validated April 2026), developed by the Ministère des Finances, Budget et Économie Numérique with UNDP support; no binding AI law in force

Burundi has no enacted AI-specific legislation or binding sectoral AI rules. On 21 April 2026, the government held an official national validation workshop in Bujumbura endorsing its National AI Strategy 2026-2030, a six-pillar non-binding policy roadmap. The strategy commits to future regulatory framework adaptation, ethics charter development, and the creation of AI steering bodies, but none of these instruments are yet in force.

Framework: Law No. 1/03 of 10 March 2026 on the Protection of Personal Data (Loi N°1/03 du 10 mars 2026 portant protection des données à caractère personnel), with oversight by an independent administrative authority placed under the Ministry of Digital Economy

Burundi enacted its first comprehensive personal data protection law on 10 March 2026, after the National Assembly unanimously adopted the bill on 15 January 2026. The law, structured in eight chapters, establishes individual rights over personal data, obligations on data controllers, and a new independent supervisory authority. Prior to this law, data protection in Burundi was only addressed through scattered sectoral provisions in banking, health, and telecommunications legislation.

Framework: Bank of the Republic of Burundi (BRB), under Law No. 01/07 of 11 May 2018 on the National Payment System, Regulation No. 002 of 2024 on payment services and payment-institution activities (replacing Reg. No. 001/2017), and Circular No. 001 of 2024 on electronic-money-issuing payment institutions.

Burundi has an in-force licensing regime for digital payments: the central bank (BRB) licenses and supervises payment institutions, payment service providers and electronic-money issuers under the 2018 National Payment System Law and dedicated 2017/2024 regulations and circulars. The BRB also operates the national instant-payment infrastructure (BurundiPay, launched April 2025) and licenses non-bank PSPs and mobile-money operators. There is no dedicated open-banking framework, and buy-now-pay-later (BNPL) is not specifically regulated.

Framework: Law No. 1/25 of 5 November 2021 on the Regulation of Migration in Burundi, administered by the Commissariat Général des Migrations (CGM) under the National Police of Burundi

Burundi has no dedicated digital-nomad or remote-work visa category. The standard work visa requires sponsorship from a locally operating employer, leaving location-independent remote workers without a formal pathway. Short-stay visitors may enter on a 30-day visa on arrival, but this does not confer work rights, and no freelancer, self-employed, or long-stay investment pathway for remote workers has been established as of 2026.

Framework: Law No. 1/10 of 16 March 2022 on the Prevention and Repression of Cybercriminality; National Communication Council (CNC) media oversight; ARCT telecommunications regulation (Decree-Law No. 100/112, 2012)

Burundi regulates online content through a 2022 cybercrime law and a media law enforced by the CNC, but has no comprehensive online safety statute comparable to the EU DSA or UK OSA. The cybercrime law criminalises broad online speech acts including spreading rumours, and the CNC actively suspends online and digital media outlets. There is no dedicated data-protection law, platform-liability regime, or age-verification framework in force.

Framework: Law N°1/10 of 16 March 2022 on Prevention and Repression of Cybercriminality; Law N°1/03 of 10 March 2026 on Personal Data Protection; Law N°1/22 of 22 August 2024 (Electronic Communications Code), all regulated by ARCT (Agence de Régulation et de Contrôle des Télécommunications)

Burundi's cybersecurity landscape is governed by a set of issue-specific laws rather than a single comprehensive cybersecurity statute. The 2022 Cybercrime Law (70 articles) criminalises offences against data confidentiality, integrity and availability, and imposes obligations on operators and service providers. The March 2026 Data Protection Law, promulgated after parliamentary adoption on 15 January 2026, fills a longstanding legal gap by establishing data-subject rights and creating an independent supervisory authority, complemented by the 2024 Electronic Communications Code that sets telecoms-sector security obligations.

Framework: Investment Code of 2021 (Law No. 1/14 of 17 June 2021); one-stop shop administered by the Agence de Promotion des Investissements (API) / Burundi Development Agency (ADB) under the Ministry of Trade

Burundi imposes no general foreign-ownership limits and allows 100% foreign equity in most sectors, with company registration theoretically completable in a single day at the ADB one-stop shop in Bujumbura for a fee of 40,000 BIF (~US$21). However, foreign investors must be physically present to register, the regulatory environment is burdened by corruption and unclear governance, and the 2021 Investment Code raised the minimum investment threshold for incentive eligibility to US$500,000 (Bujumbura) or US$250,000 (other localities), creating a high bar for smaller foreign entrants.