AzerbaijanLaw on Personal Data, enforcement and liability
Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Licensing, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app processing the personal data of a person in Azerbaijan must be prepared to answer to the relevant executive authority's compliance checks; Art. 19's own liability provision is a bare reference to other Azerbaijani law with no fine amounts stated in this Act, and an aggrieved person may separately sue in court for moral and material damage under Art. 7.4, but only on proof of the damage suffered.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Azerbaijan's Criminal Code has no personal-data-specific offense. Where processing personal data in an information system this Act requires to be registered (Art. 16) is unregistered, and that unregistered processing also amounts to entrepreneurial activity conducted without the state registration or license Criminal Code Art. 192 requires, and the activity causes especially large damage or especially large income, Art. 192.3 punishes it with a fine of four times the damage or income, or five to seven years' imprisonment, with or without up to three years' bar from holding certain positions or engaging in certain activity. Ordinary violations that do not reach this unlicensed-business, especially-large-scale threshold are not separately criminalized.
Penalty structure
Fine sits in the Administrative Violations Code (Inzibati Xetalar Mecellesi) Art. 375.0, not in this Act's own text; Art. 19 (Liability) only refers out to the legislation of the Republic of Azerbaijan without stating an amount. Applies to collecting or processing personal data in an information system that requires state registration under this Act but was not registered (Art. 375.0.1), and to a data owner or operator's failure to protect personal data, failure to destroy it within this Act's required timeframes, or failure to halt collection, processing, or transfer of it as required (Art. 375.0.2).
- Rule
- Fixed only
- As of
- Minimum
- 300
- Currency
- AZN
- Fixed cap
- 500
Who enforces it
Enforcement body
Ministry of Digital Development and Transport of the Republic of Azerbaijan, through its Electronic Security Service (Elektron Tehlukesizlik Xidmeti, operating as CERT.az), which operates the State Registry of Personal Data Information Systems (registry.pdp.az) that Art. 16 requires and that Art. 17's compliance-check power reaches; Art. 375 administrative fines and any Criminal Code Art. 192 prosecution are pursued through the ordinary courts and prosecutors rather than by this Ministry itself.
Settledness
- As of
- Open questions
- Which Azerbaijani provisions on administrative or criminal liability does Article 19 incorporate for "Persons guilty of violating this Law"?
What it makes you log
Logging duty
Article 17 lets the executive authority check compliance in registered information systems, demand information from owners and operators free of charge, and require violations to be remedied. Article 7.4 gives a right to complain and to claim damages, and Article 19 refers liability to other law. No record or log is named, so the articles impose no duty to log; the authority's power to demand information is recorded as a check on request. The control-audit journal duty is in Article 9.12, which this row does not cite.
- Kind
- None
- As of
What this law does
Art. 17 gives a relevant executive authority, not named within this Act itself, power to check compliance of registered information systems, demand information, verify registration filings, demand remedies for violations, and take measures to prosecute violators; which body currently holds that role is not confirmed.
Art. 19 (Liability) is a single sentence: persons guilty of violating this Law shall be held responsible in accordance with the legislation of the Republic of Azerbaijan, a bare reference-out to other, unread law with no fine amounts, penalty tiers, or named enforcement mechanism inside this Act itself, markedly thinner than every other jurisdiction in this batch.
Art. 7.4 gives the data subject a right to complain to the executive authority or the court, and to demand payment of moral and material damage in a court of law, an ordinary proof-of-damage civil remedy rather than a no-proof-of-damage statutory-damages mechanism. Fine amounts a secondary source claims exist in the Administrative Violations Code (300 to 500 AZN, imprisonment up to 7 years) are unconfirmed against primary text and are not stated here as sourced to this Act.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .