Processes personal data, in Azerbaijan

Arts. 9.1 to 9.4 and 11.1, Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ · Read the law's page

• Declare the purpose of collecting personal data of a person in Azerbaijan, collect only the data necessary to achieve that purpose, keep the volume and nature of the data you collect and process in line with the declared purpose, and process it only by methods that fit that purpose (Articles 9.1, 9.2 and 11.1).
• Keep personal data accurate and complete, update it when necessary, and destroy it without delay once the purpose of collecting and processing it has been achieved and the need to keep it has ended (Articles 9.3 and 9.4).

Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ (11 May 2010, as amended through 2023), Arts. 1-2, 8-13 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Azerbaijan, including a facial image or voiceprint, must have a lawful basis under Art. 9.6, most commonly consent for data in an open category or a legislative basis defining the purpose and method of processing, since Azerbaijan's law reaches biometric data under these same ordinary conditions rather than exempting it.

Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 14 · Read the law's page

• An app transferring the personal data of a person in Azerbaijan to a recipient outside Azerbaijan must ensure the destination provides legal protection at the level Azerbaijani law sets, unless the data subject has consented or the transfer is necessary to protect the subject's life or health, since Azerbaijan has no contract, binding-corporate-rule, or authority-permit route for a non-adequate destination.

Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 7 · Read the law's page

• An app holding the personal data of a person in Azerbaijan must give that person the Art. 7 rights on request, including access and correction, must immediately honor a written objection unless processing is legally mandatory, and must let a person object to a decision produced through information-technology processing that harms their interests.

Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 9.5 · Read the law's page

• An app that captures or stores a facial image, voiceprint (sound fragment and its acoustic parameters in the Act's own term), or other biometric identifier from a person in Azerbaijan is still bound by this Act's ordinary processing conditions, a lawful basis under Art. 9.6 and destruction under Art. 9.4 once the purpose is achieved, even though Azerbaijan does not treat biometric data as a heightened special category and imposes no biometric-specific consent, retention, or storage-technology duty.

Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 2.1.6, 9.7 · Read the law's page

• An app that processes race, nationality, family-life, religious-belief, health, or conviction data from a person in Azerbaijan must have a specific statutory ground for that processing under Art. 9.7; biometric data is not one of these special categories under Azerbaijan's law and is governed instead by the Act's ordinary processing conditions.

Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19 · Read the law's page

• An app processing the personal data of a person in Azerbaijan must be prepared to answer to the relevant executive authority's compliance checks; Art. 19's own liability provision is a bare reference to other Azerbaijani law with no fine amounts stated in this Act, and an aggrieved person may separately sue in court for moral and material damage under Art. 7.4, but only on proof of the damage suffered.