AzerbaijanLaw on Personal Data, comprehensive regime and lawful basis
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Azerbaijan, including a facial image or voiceprint, must have a lawful basis under Art. 9.6, most commonly consent for data in an open category or a legislative basis defining the purpose and method of processing, since Azerbaijan's law reaches biometric data under these same ordinary conditions rather than exempting it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the consent basis in Article 9.6.1, which the translated text attaches to personal data that "are open categories", also supply the lawful basis for processing confidential personal data, given that Article 8.1 permits collection and processing "only on the basis of consent given by the subject"?
- Does Law No. 998-IIIQ apply to an owner or operator established outside the Republic of Azerbaijan that collects the personal data of individuals in Azerbaijan?
What it makes you log
Logging duty
Article 9.12 makes the owner or operator ensure that records of the collection and processing of personal data in information systems, of requests made and answered, of the results of registering and examining applications, and of operations on the management and protection of the information systems are collected in control-audit journals. The article names no field of the journal, no retention period and no reader. Articles 8.4 and 8.5 separately put the burden of proving consent, or that data is open data, on the owner or operator without naming a record. The cited articles state no territorial reach (the scope clause in Article 3 is not cited), and Article 17, the executive authority's powers to check and demand information, is not cited either, so no audit or access value is taken from it. The source read is the official Azerbaijani text; the English is ours.
- Kind
- Explicit
- As of
- Provision
- Article 9.12
- Trigger
- personal_data_processing
What this law does
Azerbaijan's Law on Personal Data, Law No. 998-IIIQ, signed and amended at least five times through 2023, is a compact 19-article statute, the shortest in this batch alongside Armenia's. Lawful bases sit at Art. 9.6: consent for data in an open category, a legislative basis defining purpose and method, fully anonymized scientific or statistical research, or vital-interest necessity, a shorter list than several regional peers'.
Art. 9.5's biometric-data enumeration is subject to these same ordinary lawful bases, not a heightened regime; see the dedicated biometric privacy instrument. The text relied on here is an NATLEX-hosted English translation with visible machine-translation artifacts, not cross-checked against an official Azerbaijani-language source, though its substance is internally consistent.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .