The framework
Burundi has enacted Law No. 1/03 of 10 March 2026 on the Protection of Personal Data, but the regime is not yet fully operative.
That puts Burundi in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law No. 1/03 of 10 March 2026 on the Protection of Personal Data
Burundi enacted its first comprehensive data protection law on 10 March 2026, in force on promulgation, with six months for private-sector processing to comply and a year for the public sector. The Personal Data Protection Agency it creates still needs an implementing decree, so the law applies without a regulator to enforce it.
Marketing and advertising
A comprehensive law on the francophone African model, with consent as the main basis for processing; private-sector processing had six months to comply, a window that closed on 10 September 2026. That single sentence decides most channel plans here.
Cross-border transfers
The law sets conditions for transfers abroad, but the agency meant to supervise them has not been set up.
Enforcement and penalties
The law provides for sanctions, but no agency is yet in place to impose them.