ArmeniaLaw on Protection of Personal Data, comprehensive regime
Law of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N (2015), Arts. 1, 3-8
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Armenia must have a lawful basis for processing under Arts. 4-8 of the Law on Protection of Personal Data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does information that a third party has posted about a person on a public website count as obtained from "հանրամատչելի աղբյուրներից" ("publicly accessible sources") under Article 8(1)(2), given that Article 3(1)(15) counts as publicly accessible only information made accessible with the data subject's consent or through the data subject's own conscious actions to make it public, together with information that a law designates as publicly accessible?
- Does the Law bind a controller established outside Armenia that processes the personal data of people in Armenia, given that Article 1(1) regulates processing by "իրավաբանական կամ ֆիզիկական անձանց" ("legal or natural persons") and states no territorial reach?
What it makes you log
Logging duty
Articles 1 and 3 to 8 set the scope, the definitions, the principles of legality, proportionality, accuracy and minimal involvement of subjects, and the lawfulness of processing. None of them requires a log or a record. Article 7(4) leaves the procedure for processing in information systems and its security rules to a Government decision and the autonomous body, and names no log. The processor's duty to prove that consent was obtained is in Article 9(8), which is not among the sections this row cites, and the notification to the authorized body is in Article 23.
- Kind
- None
- As of
What this law does
Armenia's Law on Protection of Personal Data, Law No. HO-49-N, adopted by the National Assembly on and signed by the President on , took effect (Art. 28), replacing a 2002-era law on the same date. General principles at Arts. 4-8 cover legality, proportionality, accuracy, minimal subject involvement, and lawfulness-of-processing grounds, across 29 articles total, considerably shorter and less elaborated than several of this jurisdiction's regional peers.
Nine amending laws have followed, the latest being Law No. HO-191-N of . All translations of Armenian-language text here are working translations, not an official translation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .