AzerbaijanLaw on Personal Data, biometric data enumeration and general processing conditions
Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 9.5
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that captures or stores a facial image, voiceprint (sound fragment and its acoustic parameters in the Act's own term), or other biometric identifier from a person in Azerbaijan is still bound by this Act's ordinary processing conditions, a lawful basis under Art. 9.6 and destruction under Art. 9.4 once the purpose is achieved, even though Azerbaijan does not treat biometric data as a heightened special category and imposes no biometric-specific consent, retention, or storage-technology duty.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Do the conditions that Article 9.5 makes "fully applicable" to biometric data include the special-category prohibition in Article 9.7, or only the general conditions of Articles 9.1 to 9.6?
What it makes you log
Logging duty
Article 9.5 lists biometric data and applies the Act's general conditions for collection and processing to it in full. It states no duty to create, keep or produce a log or record. The control-audit journal duty is in Article 9.12, which this row does not cite.
- Kind
- None
- As of
What this law does
Art. 9.5 enumerates biometric data in detail: fingerprints and palm prints, facial image, iris and retina of the eye, sound fragment and its acoustic parameters, DNA, body-measurement results, description of special features and physical defects of the body, handwriting, signature, and other biometric data, and states that the Act's general processing conditions (Art. 9.1-9.6) are fully applicable to it.
This is a deliberate, textually confirmed choice: biometric data is not elevated to the heightened special-categories regime of Art. 9.7 that governs race, health, and similar categories elsewhere in this same Act, so there is no biometric-specific explicit-consent requirement, no dedicated retention or destruction duty, and no dedicated storage-technology requirement anywhere in this Act.
A service may create and store a voiceprint (the Act's own term is sound fragment and its acoustic parameters) or a faceprint on whatever general basis Art. 9.6 supplies for any other personal data, most plausibly consent for an open category or a legislative basis, and must destroy it only under the Act's general Art. 9.4 duty to destroy data without delay once its processing purpose has been achieved.
A reader should not infer from this instrument's classification alone that Azerbaijan treats biometric data the way this batch's other jurisdictions do; the Act plainly reaches voice and face identifiers, just not as a sensitive category.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .