BelarusLaw of the Republic of Belarus On Personal Data Protection
Zakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh v sile s 15 noiabria 2021 (Law No. 99-Z of ), arts. 1-7, 17 and 20-21 (general processing and security)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Contract terms, Security, Governance
- Audit expectation
- none
What it requires
- Establish a lawful basis, generally the personal data subject's consent unless another basis in this Law applies, before processing personal data of a person in Belarus, and limit processing to explicit, pre declared, legitimate purposes, under Article 4.NIST Privacy FrameworkCT.PO-P1
- Take consent that is freely given, unambiguous and informed, obtainable in writing, as an electronic document, or in another electronic form, and be ready to prove that it was obtained, under Article 5.NIST Privacy FrameworkCT.PO-P1
- Fix the purposes, permitted actions, confidentiality duty and protection measures in a contract, act of legislation or public authority decision before entrusting processing to an authorized person, under Article 7, and remain responsible to the personal data subject for that person's actions.NIST Privacy FrameworkID.DE-P3
- Take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, appoint a data protection officer or a dedicated unit, publish your data processing policy, and train staff who handle personal data, under Article 17.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.PO-P3NIST Privacy FrameworkGV.AT-P1
- As a republican public authority operator, publicize on your official website the information resources containing the personal data you own, under Article 16, paragraph 2.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: National Personal Data Protection Center of the Republic of Belarus (Национальный центр защиты персональных данных Республики Беларусь), the national personal data protection authority (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.AT-P1The workforce is informed and trained on its roles and responsibilities.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://cpd.by/en/national-regulation/the-belarusian-data-protection-act/
- Guidance body
- National Personal Data Protection Center of the Republic of Belarus (Национальный центр защиты персональных данных Республики Беларусь), the national personal data protection authority
- Open questions
- What must an operator show to meet the requirement in Article 4(2) that processing "ensure a fair balance of all concerned persons’ interests at all processing stages"?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 5(7) puts on the operator the obligation to prove that the personal data subject's consent was obtained, which cannot be shown without keeping a record of the consent. The Article names no log, form or retention period, so the clause states no period and no person who may demand the record. Article 17 sets protection measures, including a procedure for access to personal data in an information system, but none that names a log or a register. The cited articles state no territorial scope clause (Article 2 covers processing by automation tools or in a searchable file).
- Kind
- Implicit
- As of
- Provision
- Article 5, paragraph 7
- Trigger
- consent_or_optout
What this law does
Article 2 applies this Law to personal data processed using automation tools, or without automation tools where the data can be searched or accessed by specific criteria, and Article 2 excludes an individual's purely personal, family or household activity and data classified as a state secret.
Article 4 requires processing to be proportionate to its stated purposes, based on the personal data subject's consent except where this Law provides otherwise, limited to explicit, pre declared legitimate purposes, transparent, and no more than necessary, and requires the operator to keep the data accurate and to store it only as long as the stated purposes require.
Article 5 defines that consent as a freely given, unambiguous, informed expression of will, obtainable in writing, as an electronic document, or in another electronic form, with the burden of proving it on the operator.
Article 7 lets an operator entrust processing to an authorized person only under a contract, an act of legislation or a public authority decision that fixes the purposes, the permitted actions, a confidentiality duty and the Article 17 protection measures, and makes the operator responsible to the personal data subject for that person's actions.
Article 17 requires the operator to take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, including appointing a data protection officer or a dedicated unit, publishing a data processing policy, training staff, and implementing technical and cryptographic protection, and a republican public authority operator must publicize on its website the information resources containing personal data it owns.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .