Duty LXD-6719
Handles health records, in Belarus
Law of the Republic of Belarus On Personal Data Protection, special personal datasince 3 lines
Law No. 99-Z, arts. 1, 8 (special personal data) · Read the law's page
- Do not process special personal data, meaning data on race or nationality, political opinions, trade union membership, religious or other beliefs, sex life or health, administrative or criminal records, or biometric or genetic data, without the personal data subject's consent, unless a listed exception applies, such as the data having been publicly disclosed by the subject, a labor relations purpose, or medical care by a bound professional, under Article 8.
- Treat an image from which fingerprints, palmprints, iris or face features can be read as biometric personal data, not only a directly captured template, under the Article 1 definition.
- Adopt a set of measures against the risks processing poses to a personal data subject's rights and freedoms before relying on any Article 8 exception to process special personal data.
Law No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)in force5 lines
Law of the Republic of Belarus No. 455-Z of On Information, Informatization and Protection of Information (as amended by Law No. 209-Z of ), art. 40 · Read the law's page
- This binds you if you operate an information system or provide information services through one, reaching Belarus or established there, whatever your sector or size: Law No. 455-Z defines an information system operator broadly and lists a private legal entity or an individual entrepreneur among the subjects of information relations it reaches.
- Ensure the integrity and safety of the information your system holds.
- Take measures to prevent disclosure, loss, distortion, destruction, or unauthorized modification of that information, and to prevent blocking of legitimate access to it.
- Where necessary, take measures to restore information that has been lost.
- This duty runs independently of Belarus's comprehensive personal-data statute, Law No. 99-Z, which carries its own security and breach-notice duties recorded separately under the privacy topic; article 40 reaches whatever information your system holds, not only personal data.