Law of the Republic of Belarus On Personal Data Protection, authorized agency and liability

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Criminal Code No. 275-Z (9 July 1999, as amended by Law No. 112-Z of 26 May 2021) Art. 203-1 (“Illegal actions in relation to information on private life and personal data”): intentional illegal collection or provision of another person's private-life information and/or personal data without consent, causing substantial harm to a citizen's rights, freedoms or legitimate interests, is punishable by community service, a fine, arrest, restriction of freedom for up to two years, or deprivation of freedom for the same term (part 1); intentional illegal dissemination of the same, causing the same harm, by a fine, arrest, restriction of freedom for up to three years, or deprivation of freedom for the same term with or without a fine (part 2); either act committed against a person or their relatives because of that person's official activity or performance of a civic duty, by restriction of freedom for up to five years or deprivation of freedom for the same term with a fine (part 3, the article's maximum). A companion offence, Art. 203-2, punishes an operator's negligent failure to ensure personal-data protection measures where that failure causes the data's dissemination and grave consequences, by a fine, disqualification from holding certain positions or engaging in certain activity, corrective labor for up to one year, arrest, restriction of freedom for up to two years, or deprivation of freedom for up to one year.

Penalty structure

Law No. 99-Z itself states no fine amount; Article 19.1 refers liability to “legislative acts,” and the operative penalty clause is Code of Administrative Offences (Law No. 91-Z of 6 January 2021) Art. 23.7, which sets four separate tiers in base units (bazovaya velichina, BV): up to 50 BV for intentional illegal collection, processing, storage or provision of an individual's personal data or violation of their processing-related rights (part 1); 4 to 100 BV for the same acts by a person who knows the data through professional or official activity (part 2); up to 200 BV for intentional illegal dissemination of personal data (part 3, the article's ceiling); and, for failure to comply with data-protection security measures, 2 to 10 BV for an individual, 10 to 25 BV for a sole proprietor, and 20 to 50 BV for a legal entity (part 4). The ceiling is the part 3 figure (200 BV), converted at the base unit's current value of BYN 45 (Council of Ministers Resolution No. 651 of 20 November 2025, in effect from 1 January 2026); the lower tiers are set out above.

Rule

Fixed only

As of

2 September 2026

Currency

BYN

Fixed cap

9,000

Enforcement body

The National Center for Personal Data Protection of the Republic of Belarus, the “authorized agency for the protection of personal data subjects’ rights” designated under Law No. 99-Z Art. 18 and established by Presidential Decree No. 422 of 28 October 2021. It supervises operators' processing, reviews data subjects' complaints and citizens'/legal entities' appeals, can order an operator to change, block or delete unlawfully obtained or inaccurate data, sets the list of countries with adequate protection and issues cross-border transfer permits, and must publish an annual activity report by 15 March each year (Art. 18.3). Administrative liability under Code of Administrative Offences Art. 23.7 and criminal liability under Criminal Code Art. 203-1/203-2 are adjudicated separately from the Center's own supervisory and corrective-order process; Art. 18.3 does not list a power to impose administrative fines itself.

Enforcement record

National Center for Personal Data Protection, own annual activity report for 2025 (published under the Art. 18.3 duty). The count of actions is the 556 formal requirements (prescriptions) the Center issued in 2025 ordering operators to remedy identified violations, up from approximately 370 in 2024, a rising trend; the report frames this as its clearest count of operator-facing corrective actions actually issued. It does not count the 46 inspections conducted (an activity count, not all of which found a violation), the 580 data-subject complaints or 1,462 citizen/legal-entity appeals considered (intake counts that substantially overlap with the 556 figure, since complaint review is one of the two stated sources of the 556 orders), or private civil suits for moral damage under Art. 19.2, which the Center does not track. The report states no fines because the Center's own process results in corrective orders, not fines.

As of

2 September 2026

Trend

Rising

Source link

https://cpd.by/o-centre/otchety-o-dejatelnosti/otchet-o-dejatelnosti-za-2025-god/

Actions per year

556

Settledness

As of

30 October 2026

Open questions

• Does "liable under the legislative acts" in Article 19(1) leave the imposition of administrative fines for a violation of Law No. 99-Z to a court, rather than to the authorized agency, given that Article 18, paragraph 3 lists no power to fine?
• Is a data subject's claim for moral damage under Article 19(2) open without a prior appeal to the authorized agency under Article 15?

Logging duty

Article 18(3) lets the authorized agency exercise control over operators' processing and require operators to rectify, restrict or erase data, and Article 18(4) obliges public authorities, legal persons and individuals to give it the information needed to establish the legality of operators' actions. That is a power to demand information, and no clause of Articles 15, 18 and 19 requires the operator to keep or produce a log or record. The annual report in Article 18(3) is the agency's own. Article 19 sets liability and moral-damage compensation. The cited articles state no territorial scope clause.

Kind

None

As of

28 October 2026