BelarusLaw of the Republic of Belarus On Personal Data Protection, rights of the personal data subject
Law No. 99-Z, arts. 10-14 (rights of the personal data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Let a personal data subject withdraw consent at any time without giving reasons, and within fifteen days of that withdrawal stop processing, erase the data and notify the subject, or, where erasure is not technically possible, restrict further processing and notify the subject instead, under Article 10.NIST Privacy FrameworkCT.PO-P1
- Give a personal data subject, on request and within five working days, information on the processing of their personal data, including your identity, confirmation of processing, the data and its source, and the legal basis and purposes, or explain why you refuse, under Article 11, and rectify personal data that are incomplete, outdated or inaccurate on request.NIST Privacy FrameworkCT.PO-P3
- Give a personal data subject, once a calendar year and free of charge, information about the transmission of their personal data to third parties, under Article 12.NIST Privacy FrameworkCM.AW-P4
- Terminate processing of a personal data subject's personal data, including erasing it, within fifteen days of a demand made in the absence of a legal basis for the processing, or, where erasure is not technically possible, restrict further processing instead, under Article 13.NIST Privacy FrameworkCT.DM-P4
- Require a personal data subject exercising an Article 10 to 13 right to submit a written or electronic application under Article 14, and respond in the same form the application was made unless the subject asks otherwise.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
What the log must hold
Access record
Logging duty
Article 12(2) requires the operator, within fifteen days of an application, to give the data subject information on what personal data were transmitted and to whom during the preceding year, which can only be answered from a record of disclosures; the right is exercisable once a calendar year free of charge. The Article does not say a log must be kept, names no retention period, and sets no regulator audit, so the audit keys are none. Articles 10, 11 and 13 and 14 (withdrawal, information on processing, rectification, termination, the application procedure) name no record. The cited articles state no territorial scope clause.
- Kind
- Implicit
- As of
- Provision
- Article 12, paragraph 2
- Trigger
- personal_data_processing
What this law does
Article 10 lets a personal data subject withdraw consent at any time without giving reasons, and requires the operator, within fifteen days and absent another legal basis, to stop processing, erase the data and notify the subject, or where erasure is not technically possible to restrict further processing and notify the subject instead.
Article 11 gives a personal data subject the right to receive information on the processing of his or her personal data, including the operator's identity, confirmation of processing, the data and its source, and the legal basis and purposes, which the operator must provide within five working days or explain why it is refused, and gives the right to require rectification of personal data that are incomplete, outdated or inaccurate.
Article 12 gives a personal data subject the right to receive, once a calendar year and free of charge, information from the operator about the transmission of his or her personal data to third parties. Article 13 gives a personal data subject the right to demand the free termination of processing, including erasure, absent a legal basis for it, which the operator must carry out within fifteen days, or, where erasure is not technically possible, restrict further processing instead.
Article 14 requires a personal data subject exercising the Articles 10 to 13 rights to submit a written or electronic application to the operator, and requires the operator's response to match the form of that application unless the subject asks otherwise.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .