Data protection laws in Burundi
Burundi does not have a law that specifically regulates personal data protection. However, several laws and regulations currently in force contain data protection provisions or impose confidentiality obligations on specific types of personal information. For example, employment, banking, telecommunications and health sector laws impose some data protection requirements. Such provisions generally require covered entities to maintain the confidentiality of personal information.
- Article 2, point 8 of LAW N°1/10 of March 16, 2022 On the Prevention and Repression of Cybercriminality in Burundi defines personal data as any information of any kind, regardless of medium, including sound and image, relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or to one or more factors specific to his or her physical, physiological, genetic, mental, cultural, social or economic identity. This law provides for sanctions against individuals (articles 61, 62 ,63) and service providers or any network operator (articles 14,15);
- Under Law no. 1/07 of march 12, 2020 amending Law n° 1/012 of May 30, 2018 on the Code of Health Care and Health Services Provision in Burundi, healthcare institutions are required to maintain the confidentiality of patient information, unless confidentiality is waived in cases provided for by law;
- Law No. 1/17 of August 22, 2017 governing banking activities: Article 133 imposes confidentiality obligations on customer and account information. This article provides that any person who contributes to the operation, control or supervision of a banking institution is bound to professional secrecy. Violations are enforced under penal code provisions without prejudice to disciplinary proceedings;
- Under Law n°1/11 of November 24, 2020 revisioning decree-law n°1/037 of 07/07/1993 revisioning the labor code of Burundi, labor and social security inspectors, their agents, as well as persons having participated in any capacity whatsoever in any controls, examinations or investigations in collaboration with the labor and social security inspector are bound by professional secrecy (article 430);
- Several Ministerial Orders applicable to the telecommunications sector have been adopted to protect the privacy of and restrict access to and interception of the contents of communications (Legislative Decree No. 100/153 of June 17, 2013 on the Regulation of the Control and Taxation System for International Telephone Communications entering Burundi; Decree-Law No. 100/112 of April 5, 2012 on the Reorganization and Operation of the Telecommunications Regulatory and Control Agency 'ARCT'; Ministerial Ordinance No. 730/1056 of November 7, 2007 on the interconnection of telecommunications networks and services opened to the public).
