BelarusLaw of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations
Law No. 99-Z, art. 16.1 (notification of personal data protection violations)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the National Center for Personal Data Protection immediately, and in any case no later than three working days after becoming aware of a violation of your personal data protection systems, under Article 16, unless the Center itself provides otherwise.
- Do not rely on this Law for a duty to notify an affected personal data subject of a personal data protection violation; it states none.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 16(1) requires the operator to notify the authorized agency of violations of personal data protection systems immediately and within three working days. It is a duty to notify and names no duty to document, log or keep a record of the violation. The cited article states no territorial scope clause.
- Kind
- None
- As of
What this law does
Article 16 requires the operator to notify the authorized agency for the protection of personal data subjects' rights of a violation of personal data protection systems immediately, and no later than three working days after the operator became aware of it, except as the agency itself otherwise provides. This Law states no separate duty to notify an affected personal data subject of the violation, and no content requirements for the notification to the agency beyond the deadline itself.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .