Skip to content
World Watch

Data protection & privacy law in Burundi (2026)

Data protection in Burundi: comprehensive law.

Burundi enacted its first comprehensive personal data protection law on 10 March 2026, after the National Assembly unanimously adopted the bill on 15 January 2026. The law, structured in eight chapters, establishes individual rights over personal data, obligations on data controllers, and a new independent supervisory authority. Prior to this law, data protection in Burundi was only addressed through scattered sectoral provisions in banking, health, and telecommunications legislation.

Last verified Official sources first · MethodologyCompare Burundi with other countries

Legal framework

Law No. 1/03 of 10 March 2026 on the Protection of Personal Data (Loi N°1/03 du 10 mars 2026 portant protection des données à caractère personnel), with oversight by an independent administrative authority placed under the Ministry of Digital Economy

Key points: data & privacy in Burundi

  1. Enactment & Entry into Force

    Law No. 1/03 was promulgated on 10 March 2026 and published on the official ARCT portal. The National Assembly adopted it unanimously on 15 January 2026, marking Burundi's first standalone data protection instrument.

    arct.gov.bi

  2. Scope & Definition

    The law defines personal data as any information linked to an identified or identifiable natural person, directly or indirectly, by reference to physical, genetic, social, cultural, or economic identity, a broad, GDPR-influenced definition.

    arct.gov.bi cybersecuritymag.africa

  3. Supervisory Authority

    The law creates a new independent administrative authority responsible for implementing data protection regimes, placed under the supervision of the Ministry of Digital Economy. No pre-existing dedicated data protection authority existed prior to this law.

    techafricanews.com wearetech.africa

  4. Individual Rights & Controller Obligations

    The eight-chapter structure covers data subjects' rights (access, correction, erasure) and sets out binding obligations for data controllers. It establishes different protection regimes tailored to varying processing activities.

    arct.gov.bi cybersecuritymag.africa

  5. Sanctions & Criminal Penalties

    The law introduces specific criminal penalties for unlawful processing of personal data, designed to be compatible with Burundi's Penal Code and the existing Cybercrime Law, deterring abusive or illegal use of personal information.

    jupiterinfo.bj arib.info

  6. Prior Sectoral Baseline

    Before the 2026 law, data protection obligations existed only in sector-specific rules: banking confidentiality (Law No. 1/17 of 22 August 2017), healthcare institution confidentiality, and telecommunications provisions, with no unified framework or data protection authority.

    dlapiperdataprotection.com dataprotection.africa

Sources

  1. arct.gov.bi/2026/03/18/loi-n1-03-du-10-mars-2026-portant-protection-des-donnees-a
  2. techafricanews.com/2026/01/16/burundi-adopts-landmark-personal-data-protection-law-to-sa
  3. cybersecuritymag.africa/protection-des-donnees-a-caractere-personnel-le-parlement-burundais-a
  4. wearetech.africa/en/fils-uk/news/tech/burundi-lawmakers-approve-data-protection-framew
  5. dlapiperdataprotection.com/index.html?t=law&c=BI
  6. dataprotection.africa/burundi/
  7. jupiterinfo.bj/2026/01/16/burundi-loi-protection-donnees-personnelles-adoptee/
  8. arib.info/index.php?option=com_content&task=view&id=23568&Itemid=138

Next for Burundi: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026