Burundi’s lawmakers have unanimously approved a new law regulating the collection, processing and use of personal data, a move aimed at strengthening trust in digital systems as the country accelerates the digitalisation of public administration and services.
The bill was adopted on Thursday during a plenary session of the National Assembly in Kigobe, marking Burundi’s first comprehensive legal framework dedicated to personal data protection.
Authorities say the legislation is designed to close regulatory gaps exposed by the rapid expansion of digital tools across government institutions, the private sector and everyday life.
The law was sponsored by the Ministry of Interior, Community Development and Public Security, which argued that existing legislation no longer provided sufficient safeguards as the volume of sensitive personal data increased.
Burundi has in recent years expanded computerised systems in public administration, digitised its voter register and advanced the rollout of a biometric national identity card. Officials say those initiatives have significantly increased the collection and storage of personal information, heightening the risk of misuse and data breaches.
The new legislation establishes key principles governing data protection, including the requirement that personal data be collected lawfully, processed transparently and used only for specified purposes. It emphasises respect for fundamental rights and freedoms, including the right to privacy.
The law also creates an independent administrative authority responsible for overseeing compliance, handling complaints and enforcing sanctions. Lawmakers said the creation of an autonomous regulator was essential to ensuring credibility and accountability in the implementation of the new framework.
In addition to administrative oversight, the legislation introduces specific criminal penalties for violations of data protection rules. Those provisions are intended to complement existing cybercrime laws and deter the unauthorised use, disclosure or exploitation of personal data.
More Read
During parliamentary debates, lawmakers highlighted growing public concern over data security, particularly as digital platforms become more central to access to public services. Supporters of the bill said stronger legal safeguards were necessary to reassure citizens and encourage wider adoption of digital systems.
Officials also framed the reform as part of Burundi’s effort to align with regional and international standards on digital governance.
Across Africa, governments have increasingly moved to adopt data protection laws in response to rapid digitalisation, cross-border data flows and the expansion of fintech, e-government and biometric identification systems.
The African Union has promoted legal harmonisation through the Malabo Convention on cybersecurity and personal data protection, which provides a continental framework for digital security and privacy. According to AU data, around 39 African countries have already enacted dedicated data protection legislation, while several others are in the process of drafting or reviewing laws.
Burundi’s new framework brings the country closer to those standards and is expected to facilitate cooperation with regional and international partners, particularly in areas involving digital services and information sharing.
At the national level, the law is also seen as a key enabler for the deployment of the biometric national identity card, a flagship government project aimed at improving access to public services and strengthening civil registration.
More Read
Authorities say technical preparations for the ID system are already under way. Registration software has been installed and aligned with Burundi’s revised administrative boundaries, and pilot testing is currently taking place in around a dozen communes.
Officials have said a phased nationwide rollout will follow once testing is completed, with the new data protection framework providing the legal basis for safeguarding citizens’ information.
Analysts say the effectiveness of the law will depend on the independence and capacity of the new data protection authority, as well as public awareness of individual rights and obligations.
They also note that enforcement could pose challenges in a context where digital infrastructure and institutional resources remain limited.
Nevertheless, supporters of the reform argue that the law represents an important step in securing Burundi’s digital transformation and building confidence among citizens, businesses and development partners.
As digital systems become increasingly central to governance and service delivery, authorities say ensuring the protection of personal data will be critical to sustaining progress and preventing abuses.
