Processes personal data, in Belarus

Law No. 99-Z, art. 16.1 (notification of personal data protection violations) · Read the law's page

• Notify the National Center for Personal Data Protection immediately, and in any case no later than three working days after becoming aware of a violation of your personal data protection systems, under Article 16, unless the Center itself provides otherwise.
• Do not rely on this Law for a duty to notify an affected personal data subject of a personal data protection violation; it states none.

Law No. 99-Z, art. 9 (cross border transfer of personal data) · Read the law's page

• Confirm the destination country is on the authorized agency's adequate-country list before transferring personal data of a person in Belarus outside the country, or rely on one of the seven Article 9 exceptions, such as the subject's informed consent to the risks or performance of a contract with the subject, or obtain the agency's own permit.
• This law has no Standard Contractual Clauses or Binding Corporate Rules self-assessment route for a cross-border transfer; an operator outside the adequate-country list and outside the Article 9 exceptions needs the authorized agency's case-by-case permit.

Law No. 99-Z, arts. 1, 8 (special personal data) · Read the law's page

• Do not process special personal data, meaning data on race or nationality, political opinions, trade union membership, religious or other beliefs, sex life or health, administrative or criminal records, or biometric or genetic data, without the personal data subject's consent, unless a listed exception applies, such as the data having been publicly disclosed by the subject, a labor relations purpose, or medical care by a bound professional, under Article 8.
• Treat an image from which fingerprints, palmprints, iris or face features can be read as biometric personal data, not only a directly captured template, under the Article 1 definition.
• Adopt a set of measures against the risks processing poses to a personal data subject's rights and freedoms before relying on any Article 8 exception to process special personal data.

Law No. 99-Z, arts. 10-14 (rights of the personal data subject) · Read the law's page

• Let a personal data subject withdraw consent at any time without giving reasons, and within fifteen days of that withdrawal stop processing, erase the data and notify the subject, or, where erasure is not technically possible, restrict further processing and notify the subject instead, under Article 10.
• Give a personal data subject, on request and within five working days, information on the processing of their personal data, including your identity, confirmation of processing, the data and its source, and the legal basis and purposes, or explain why you refuse, under Article 11, and rectify personal data that are incomplete, outdated or inaccurate on request.
• Give a personal data subject, once a calendar year and free of charge, information about the transmission of their personal data to third parties, under Article 12.
• Terminate processing of a personal data subject's personal data, including erasing it, within fifteen days of a demand made in the absence of a legal basis for the processing, or, where erasure is not technically possible, restrict further processing instead, under Article 13.
• Require a personal data subject exercising an Article 10 to 13 right to submit a written or electronic application under Article 14, and respond in the same form the application was made unless the subject asks otherwise.

Law No. 99-Z, arts. 15, 18-19 (authorized agency and liability) · Read the law's page

• Expect a personal data subject in Belarus to be able to appeal your actions, inaction or decisions to the National Center for Personal Data Protection, and then to a court, under Article 15.
• Comply with the National Center's requirement to rectify, restrict or erase false or illegally obtained personal data, or to eliminate another violation of this Law, under Article 16 and Article 18, paragraph 3.
• Expect a person in Belarus to have a claim for moral damage under Article 19 for a breach of their rights under this law, separate from the National Center's own corrective process, and expect liability under other legislative acts for violating this Law.

Zakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of 7 May 2021), arts. 1-7, 17 and 20-21 (general processing and security) · Read the law's page

• Establish a lawful basis, generally the personal data subject's consent unless another basis in this Law applies, before processing personal data of a person in Belarus, and limit processing to explicit, pre declared, legitimate purposes, under Article 4.
• Take consent that is freely given, unambiguous and informed, obtainable in writing, as an electronic document, or in another electronic form, and be ready to prove that it was obtained, under Article 5.
• Fix the purposes, permitted actions, confidentiality duty and protection measures in a contract, act of legislation or public authority decision before entrusting processing to an authorized person, under Article 7, and remain responsible to the personal data subject for that person's actions.
• Take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, appoint a data protection officer or a dedicated unit, publish your data processing policy, and train staff who handle personal data, under Article 17.
• As a republican public authority operator, publicize on your official website the information resources containing the personal data you own, under Article 16, paragraph 2.when it serves a public body

Law of the Republic of Belarus No. 455-Z of 10 November 2008 On Information, Informatization and Protection of Information (as amended by Law No. 209-Z of 10 October 2022), art. 40 · Read the law's page

• This binds you if you operate an information system or provide information services through one, reaching Belarus or established there, whatever your sector or size: Law No. 455-Z defines an information system operator broadly and lists a private legal entity or an individual entrepreneur among the subjects of information relations it reaches.
• Ensure the integrity and safety of the information your system holds.
• Take measures to prevent disclosure, loss, distortion, destruction, or unauthorized modification of that information, and to prevent blocking of legitimate access to it.
• Where necessary, take measures to restore information that has been lost.
• This duty runs independently of Belarus's comprehensive personal-data statute, Law No. 99-Z, which carries its own security and breach-notice duties recorded separately under the privacy topic; article 40 reaches whatever information your system holds, not only personal data.