There is no requirement to appoint a data protection officer.
Burundi does not have a law that specifically regulates personal data protection. However, several laws and regulations currently in force contain data protection provisions or impose confidentiality obligations on specific types of personal information. For example, employment, banking, telecommunications and health sector laws impose some data protection requirements. Such provisions generally require covered entities to maintain the confidentiality of personal information.
- Article 2, point 8 of LAW N°1/10 OF MARCH 16, 2022 ON THE PREVENTION AND REPRESSION OF CYBERCRIMINALITY IN BURUNDI defines personal data as any information of any kind, regardless of medium, including sound and image, relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or to one or more factors specific to his or her physical, physiological, genetic, mental, cultural, social or economic identity. This law provides for sanctions against individuals (articles 61, 62 ,63) and service providers or any network operator (articles 14,15);
- Under Law no. 1/07 of march 12, 2020 amending Law n° 1/012 of May 30, 2018 on the Code of Health Care and Health Services Provision in Burundi, healthcare institutions are required to maintain the confidentiality of patient information, unless confidentiality is waived in cases provided for by law;
- Law No. 1/17 of August 22, 2017 governing banking activities: Article 133 imposes confidentiality obligations on customer and account information. This article provides that any person who contributes to the operation, control or supervision of a banking institution is bound to professional secrecy. Violations are enforced under penal code provisions without prejudice to disciplinary proceedings;
- Under Law n°1/11 of November 24, 2020 revisioning decree-law n°1/037 of 07/07/1993 revisioning the labor code of Burundi, labor and social security inspectors, their agents, as well as persons having participated in any capacity whatsoever in any controls, examinations or investigations in collaboration with the labor and social security inspector are bound by professional secrecy (article 430);
- Several Ministerial Orders applicable to the telecommunications sector have been adopted to protect the privacy of and restrict access to and interception of the contents of communications (Legislative Decree No. 100/153 of June 17, 2013 on the Regulation of the Control and Taxation System for International Telephone Communications entering Burundi; Decree-Law No. 100/112 of April 5, 2012 on the Reorganization and Operation of the Telecommunications Regulatory and Control Agency 'ARCT'; Ministerial Ordinance No. 730/1056 of November 7, 2007 on the interconnection of telecommunications networks and services opened to the public).
Definition of personal data
Not specifically defined.
Definition of sensitive personal data
Not specifically defined.
There is no national data protection authority in Burundi.
There is no requirement to register databases.
There is no requirement to appoint a data protection officer.
Most sector specific laws and regulations that impose confidentiality and data protection requirements apply to covered entities under the law or regulation, and require such entities to maintain the confidentiality of personal information during processing.
No geographic transfer restrictions apply in Burundi. Certain sector specific provisions require companies to obtain consent prior to third party transfers of personal information. Notably, under Article 16 of Law n ° 1/012 of May 30, 2018 on the Code of Health Care and Health Services Provision in Burundi, "every patient has the right to decide on the use of the medical information concerning him and the conditions under which they may be transmitted to third parties."
There are no specific data security requirements in Burundi.
There are no breach notification requirements in Burundi.
The relevant sector specific agency or regulator is generally authorized to enforce violations of confidentiality requirements.
There are no specific electronic marketing requirements in Burundi.
There are no specific online privacy requirements in Burundi.