AzerbaijanLaw on Personal Data, special categories of personal data
Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 2.1.6, 9.7
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes race, nationality, family-life, religious-belief, health, or conviction data from a person in Azerbaijan must have a specific statutory ground for that processing under Art. 9.7; biometric data is not one of these special categories under Azerbaijan's law and is governed instead by the Act's ordinary processing conditions.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "convictions" in Article 2.1.6, which lists "religious beliefs and convictions, health or convictions" among the special categories of personal data, cover criminal convictions, political or philosophical convictions, or both?
What it makes you log
Logging duty
Article 2.1.6 defines special categories of personal data and Article 9.7 bars their collection and processing except in listed cases. Neither states a duty to create, keep or produce a log or record. The control-audit journal duty is in Article 9.12, which this row does not cite.
- Kind
- None
- As of
What this law does
Art. 2.1.6 defines special categories of personal data as data related to a natural person's race or nationality, family life, religious beliefs and convictions, or health or convictions. Biometric data is not included in this list.
Art. 9.7 prohibits processing a special category absent a specific statutory ground; because biometric data sits outside Art. 2.1.6 entirely, it is not subject to this heightened Art. 9.7 regime at all, and is instead governed only by the Act's ordinary general processing conditions (Art. 9.1-9.6), covered in a separate biometric privacy instrument. This instrument therefore covers exactly the categories from which Azerbaijan's law excludes biometric data.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .