Loi 1/03 arts. 19-20 — the automated decision a human must retake from scratch, and the first statute here to name AI in an operative duty
Binds Responsables du traitement and sous-traitants. Art. 2 applies the Law to any automated or non-automated processing of personal data by a natural person, the State, local authorities and legal persons of public or private law; to any processing by a controller or processor «établi ou non sur le territoire burundais» that resorts to processing means situated in Burundi, excluding means used only for transit; and to processing concerning public security, defence, the investigation and prosecution of criminal offences or State security, subject to the derogations the Law itself defines and to specific provisions in other legislation. A controller or processor not established in Burundi designates a representative established there unless its processing is occasional, without prejudice to actions that may be brought against it. Art. 3 excludes processing by a natural person in the exclusive framework of personal or domestic activities provided the data are not intended for systematic communication to third parties or dissemination, and temporary technical copies made for automatic, intermediate and transitory storage in transmission and network-access activities. Impact tier: all entities — arts. 19 and 20 turn on the effects of the decision, legal or important effects on the data subject's situation, not on the size or sector of the entity taking it, and art. 17(7)'s artificial-intelligence disclosure item attaches to every collection of personal data from the data subject regardless of effect.. Articles 19 and 20 of Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel give Burundi the most demanding automated-decision regime on the tracker, and the Law is also the first tracked data-protection statute to name l'intelligence artificielle in an operative duty rather than in a recital or a definition. Art. 20 is a permission rule, not a right to object: «les prises de décisions automatisées produisant des effets juridiques ou des effets importants sur la situation de la personne concernée, ne sont autorisées que lorsque» they are provided for by a legislative or regulatory act laying down appropriate safeguards, taken with the data subject's consent, or strictly necessary for the conclusion or performance of a contract between the data subject and the controller. Where such a decision is permitted it must be accompanied by an individual motivation — which, the article concedes, may itself be produced by automated processing — and then comes the limb that has no equivalent anywhere else on the tracker: after learning the decision and its motivation, the data subject «a le droit de faire reformuler la décision», is invited by the controller to submit written observations in support of their case, and «une nouvelle décision motivée est prise par un être humain, qui remplace entièrement la première». Not a right to human intervention alongside the machine, as in GDPR art. 22(3), but a right to have the automated decision vacated and retaken by a person. Art. 19 supplies the transparency half twice over. Its first paragraph: where an automated decision produces legal effects or important effects on the data subject's situation, the existence of the automatism must be signalled to them and «la logique sous-jacente du traitement lui être expliquée en termes clairs et simples» — explained in clear and simple terms, a plain-language standard rather than the GDPR's «informations utiles». Its second paragraph reaches the decision-support case that most statutes leave untouched: where the processing merely aids a decision with such effects, the controller «décrit l'apport propre du décideur humain intervenant après l'automatisme, en particulier les méthodes et les critères sur lesquels il fonde son appréciation» — describes what the human decider actually added after the machine, and on what methods and criteria. That is a rubber-stamp rule: it puts the burden on the controller to show the human in the loop did something. Art. 20 closes with a sentence whose drafting is imperfect in the gazetted text — «Les motivations de la décision humaine ne peuvent s'appuyer que sur les résultats du traitement automatisé opaque» — which as printed says the opposite of what its Kirundi column and its context indicate, namely that the human decision's reasons cannot rest on opaque automated output; it is quoted here as gazetted rather than silently corrected. Upstream of all of this, art. 17(7) makes «du traitement des données à l'aide de l'intelligence artificielle pour la prise de décision automatisée» a mandatory item of the information the controller gives the data subject at the moment the data are obtained, and art. 21 carries the same list, plus the source of the data, into indirect collection with a one-month deadline. Impact tier: all entities.
Force, and the date is exact. Art. 55, the final article, provides «La présente loi entre en vigueur le jour de sa promulgation», and the instrument closes «Fait à Gitega, le 10 mars 2026», signed by President Evariste Ndayishimiye and countersigned by the Minister of Justice, Human Rights and Gender, Alfred Ahingejeje, under the seal of the Republic — so entry into force is 10 March 2026 with no vacatio legis. Art. 54 abrogates all earlier contrary provisions. Two forward deadlines follow from art. 53, which requires all processing to answer the Law's prescriptions within, from entry into force, one year for processing carried out on behalf of the State, a public establishment, a local authority or a private legal person charged with a public-service mission — 10 March 2027 — and six months for processing carried out on behalf of anyone else — 10 September 2026. Art. 52 leaves public-sector processing that predates entry into force subject only to a declaration to the data-protection organ. Neither transition suspends arts. 19 and 20 for processing begun after 10 March 2026. Supersession: none; the Law is four months old. Text read in the copy published by the Agence de Régulation et de Contrôle des Télécommunications, the Burundian regulator, on its own gov.bi site, which posted it on 18 March 2026; the file is the signed and sealed original, 32 pages, printed in parallel French and Kirundi columns with the initials of the signatories on every page, and it is image-only (Flate-wrapped DCTDecode page streams, no text layer), so it was read as page images. Coverage of the read: arts. 1-3 object, scope and exclusions; the head of the art. 4 definitions; arts. 11-12 on processors; the whole of the automated-decision material — arts. 17 information at collection, 19 explanation duties, 20 permission rule and human re-decision, 21 indirect collection and 22 opposition — verbatim; art. 46 breach notification; and the whole of Chapitre VII, arts. 47-51, and Chapitre VIII, arts. 52-55. Confidence high on the substance: arts. 19, 20 and 17(7) were read verbatim in the signed original and the entry-into-force clause is explicit and dated on its face. Two points are recorded as read rather than resolved. First, the art. 20 closing sentence quoted in the summary is defective as gazetted and no corrigendum was found. Second, «intelligence artificielle» appears in the operative text of art. 17(7) but is not defined: the art. 4 definitions run in French alphabetical order and no artificial-intelligence entry sits between «fichier de données à caractère personnel» and «personne concernée par un traitement», where one would fall. Institutionally the Law creates a data-protection organ and, per the regulator's own announcement and the parliamentary record of the 15 January 2026 adoption, an agency under the Ministry with responsibility for the digital economy; the standing-up of those bodies was not verified against primary text in this pass and no claim about their present operation is made here.
Stated maximum penalty — Up to 20,000,000 Burundian francs for a private legal person, or six months to five years' imprisonment with a fine of 500,000 to 10,000,000 francs for a natural person, and the route to arts. 19-20 is indirect: the penal chapter, arts. 47-51, names no article of the Law, so the automated-decision provisions are enforced through the general offences rather than through a limb of their own. The one that fits them is art. 48, which punishes whoever, even absent any data breach, has collected or processed data «de manière déloyale, illicite ou non transparente au regard des personnes concernées» for purposes that are undetermined, non-explicit, illegitimate or incompatible with the original purposes — the non-transparency limb is what an undisclosed automated decision or an unexplained logic engages. It carries six months to five years' penal servitude and a fine of 500,000 to 10,000,000 Burundian francs, or one of those penalties alone, where the author is a natural person, and a fine of 5,000,000 to 20,000,000 francs where the offence was committed by a private legal person, that second figure being doubled where the offender is a responsable majeur de traitement. Art. 47 punishes any personal-data breach with three months to one year and a fine of 50,000 to 500,000 francs for an intentional natural person, or 1,000,000 to 20,000,000 francs for a private legal person, and allows a suspension of activities of up to six months on recidivism where the legal person is a responsable majeur de traitement. Art. 50 sets 500,000 to 5,000,000 francs for processing revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership or health data, and for biometric processing for the selective identification of a natural person, outside the art. 10 conditions. Art. 49 punishes obstruction of archival, scientific, historical or statistical processing. Art. 51 preserves the penal provisions of other laws, naming the cybercrime law and the Penal Code, so the fines above are floors rather than the whole exposure. Upstream of the criminal route, art. 46 obliges the controller to notify the data subjects themselves, within 96 hours of becoming aware, of a breach of the obligations flowing from processing liable to create a high risk to their rights and freedoms, in clear and simple terms.