Burundi

Burundi's comprehensive personal-data statute is Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, adopted unanimously by the National Assembly on 15 January 2026 and promulgated on 10 March 2026.

Burundi's telecommunications regulator, the Agence de Régulation et de Contrôle des Télécommunications (ARCT), publishes the law and confirms its title and promulgation date; the enacted text itself is not publicly available through a reachable channel, so public-data coverage, a publicly-available exemption, biometric sensitivity, and the cross-border transfer standard are not established.

A contemporaneous secondary account of the bill describes it as organized into eight chapters covering, among other things, the rights of persons regarding the processing of their personal data, the obligations of data controllers, the protection and oversight body the law creates, and the rules applicable to data processors, and states that the bill's sanctions for violations would apply without prejudice to the Penal Code or to Burundi's separate cybercriminality statute.

Before this law, Burundi's data landscape rested on Decree No. 100/085 of July 25, 2018, establishing a national framework for data collection, dissemination, access, archiving, and security, and on the Electronic Communications Code (2024), which strengthened communications confidentiality and established computer incident response centers (CERTs).

Law No. 1/10 of March 16, 2022 on cybercriminality separately defines personal data and sanctions online privacy violations such as identity theft and disinformation.

Open-web crawling of public pages carries no dedicated Burundian statute.

Burundi's applicable computer-misuse authority is its dedicated cybercrime statute, Law No. 1/10 of March 16, 2022 on the Prevention and Repression of Cybercriminality; the regulator that publishes it, the Agence de Régulation et de Contrôle des Télécommunications (ARCT), confirms the law's title and promulgation date; the statute's text is not publicly available through a reachable channel, so its specific provisions, and how authorization is read for a public, unauthenticated page, are not established.

No statute or case law addressing terms-of-service enforceability (browsewrap versus clickwrap), or whether login or acceptance of terms changes the legal picture, was located.

Copyright protects a database as a compilation rather than through a separate sui generis database right: Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights excludes reproducing all or major parts of a database in digital format even from its otherwise-permitted private-copy exception (Article 26(1)(a)), meaning a database is a protected work whose substantial reproduction the rights holder can otherwise prevent.

The same Law excludes official texts, daily news, and mere facts and data from copyright protection altogether (Article 7), and its enumerated exceptions are quotation, press-review, and current-events reporting (Article 26) rather than a general fair-use or text-and-data-mining carve-out; nothing in the Law addresses AI training specifically, and it predates that concept.

Personal-data reach over scraped public personal data is governed by Law No. 1/03 of March 10, 2026 on the Protection of Personal Data; its enacted text is likewise not publicly available, so whether it carves out publicly available personal data is not established. No specific unfair-competition or misappropriation doctrine addressed to scraping, and no case law or regulatory statement giving robots.txt legal weight or addressing AI-training-specific access rules, was located.

Burundi has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question.

The relevant instrument is Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, which excludes daily news published, broadcast or communicated in public, and mere facts and data, from copyright protection outright (Article 7).

The same Law lets a person, once a work has been lawfully published and the source and author's name are credited, quote a work including newspaper articles and periodicals in the form of press summaries, so long as the quotation is compatible with fair practice and does not exceed the extent justified by its purpose (Article 26(1)(b)), and separately lets a current economic, political or religious news article, or a broadcast of the same character, be reproduced in the press or communicated to the public so long as the source is clearly indicated, unless the article or broadcast was itself accompanied by an express condition prohibiting such use (Article 26(2)).

Nothing limits either exception to a headline-length or short-extract threshold, and no reported Burundian court decision applying either to a systematic news aggregator, as opposed to a traditional press review, was located. The Law predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists either.