BelarusLaw of the Republic of Belarus On Personal Data Protection, cross border transfer of personal data
Law No. 99-Z, art. 9 (cross border transfer of personal data)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Confirm the destination country is on the authorized agency's adequate-country list before transferring personal data of a person in Belarus outside the country, or rely on one of the seven Article 9 exceptions, such as the subject's informed consent to the risks or performance of a contract with the subject, or obtain the agency's own permit.
- This law has no Standard Contractual Clauses or Binding Corporate Rules self-assessment route for a cross-border transfer; an operator outside the adequate-country list and outside the Article 9 exceptions needs the authorized agency's case-by-case permit.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 9 prohibits cross-border transfer where the destination country lacks an adequate level of protection, subject to listed exceptions including the agency's permit, and lets the agency fix the list of adequate countries. No clause requires a log, register or record of transfers to be kept or produced. The cited article states no territorial scope clause.
- Kind
- None
- As of
What this law does
Article 9 prohibits cross-border transfer of personal data where an adequate level of protection of personal data subjects' rights is not provided in the destination country, unless one of seven listed exceptions applies, including the personal data subject's informed consent to the risks, performance of a contract with the subject, a transfer the subject could obtain by request under legislation, protecting vital interests where consent cannot be obtained, execution of a Belarusian treaty, financial monitoring against money laundering or terrorist financing, or a permit from the authorized agency.
Article 9 also gives the authorized agency for the protection of personal data subjects' rights the power to determine the list of foreign countries whose territory ensures an appropriate level of protection, so an operator transferring to a country outside that list needs one of the other Article 9 exceptions or the agency's own permit.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .