BelarusLaw No. 455-Z, Information System Operator's Duty to Protect Information (Article 40)
Law of the Republic of Belarus No. 455-Z of On Information Informatization and Protection of Information (as amended by Law No. 209-Z of ), art. 40
In force.
A security baseline statutes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- This binds you if you operate an information system or provide information services through one, reaching Belarus or established there, whatever your sector or size: Law No. 455-Z defines an information system operator broadly and lists a private legal entity or an individual entrepreneur among the subjects of information relations it reaches.
- Ensure the integrity and safety of the information your system holds.NIST CSF 2.0PR.DS-01
- Take measures to prevent disclosure, loss, distortion, destruction, or unauthorized modification of that information, and to prevent blocking of legitimate access to it.NIST CSF 2.0PR.DS-01
- Where necessary, take measures to restore information that has been lost.NIST CSF 2.0RC.RP-02
- This duty runs independently of Belarus's comprehensive personal-data statute, Law No. 99-Z, which carries its own security and breach-notice duties recorded separately under the privacy topic; article 40 reaches whatever information your system holds, not only personal data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Criminal exposure note
Article 41 of Law No. 455-Z makes a bare cross-reference to unspecified legislative acts of the Republic of Belarus for the liability that attaches to any violation of the Law, including article 40, and does not itself create a criminal offense. The Criminal Code's own computer-security chapter (articles 349 to 355) punishes a person who defeats a protection system or unlawfully accesses, copies, or sabotages computer information, an intruder-facing offense filed under the scraping topic rather than a criminal penalty for an operator's failure to satisfy article 40's own duty; no separate criminal offense for that failure is confirmed present in the sources reachable here.
Who enforces it
Enforcement body
No single enforcement body is named for a violation of article 40 within Law No. 455-Z's own text. Article 8 assigns overlapping public regulation and administration in the field of information, informatization, and protection of information to the President, the Council of Ministers, the National Academy of Sciences, the Operation and Analysis Center under the President, and the Ministry of Communications and Informatization, without naming which of them acts on an article 40 breach specifically.
Settledness
- As of
- Open questions
- Does a Belarusian court or regulator read article 40's duty as binding immediately, or does it treat the duty as awaiting a further legislative act specifying the cases in which it applies, the way article 31's parallel duty in the same chapter is expressly qualified?
- Which legislative act does article 41 point to for the liability that attaches to a violation of article 40, and does that act set a specific penalty amount?
What this law does
Article 40 of Law No. 455-Z of On Information, Informatization and Protection of Information obliges an information system operator to ensure the integrity and safety of information contained in its information system.
The same article also requires the operator to take measures preventing the disclosure, loss, distortion, destruction, or unauthorized modification of that information and the blocking of legitimate access to it, and, where necessary, to take measures to restore lost information. Article 1 defines an information system operator as any subject of information relations that operates an information system or provides information services through it.
Article 5 lists legal entities and individual entrepreneurs among the subjects of information relations the Law reaches, so the duty binds a private-sector operator rather than only a state body. The duty carries no personal-data trigger, sector gate, or size threshold, and it applies to whatever information the operator's system contains.
That is a stricter reading than article 31's parallel information-holder duty in the same chapter, which the Law itself qualifies to apply only in cases established by the legislation of the Republic of Belarus, a qualifier article 40's own obligation does not carry.
Article 41 makes a bare cross-reference to unspecified legislative acts of the Republic of Belarus for the liability that attaches to a violation, without stating a penalty amount, an enforcement body, or a specific offense for this duty within the Law's own text. Article 44 provides that the Law enters into force six months after its official publication, and no official source stating the resulting calendar day has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .