LexLint

Know the law your code answers to.

Law / Belarus

Law of the Republic of Belarus On Personal Data Protection

Zakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh v sile s 15 noiabria 2021 (Law No. 99-Z of 7 May 2021), arts. 1-7, 17 and 20-21 (general processing and security)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 November 2021.

A comprehensive regime rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Establish a lawful basis, generally the personal data subject's consent unless another basis in this Law applies, before processing personal data of a person in Belarus, and limit processing to explicit, pre declared, legitimate purposes, under Article 4.
  • Take consent that is freely given, unambiguous and informed, obtainable in writing, as an electronic document, or in another electronic form, and be ready to prove that it was obtained, under Article 5.
  • Fix the purposes, permitted actions, confidentiality duty and protection measures in a contract, act of legislation or public authority decision before entrusting processing to an authorized person, under Article 7, and remain responsible to the personal data subject for that person's actions.
  • Take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, appoint a data protection officer or a dedicated unit, publish your data processing policy, and train staff who handle personal data, under Article 17.
  • As a republican public authority operator, publicize on your official website the information resources containing the personal data you own, under Article 16, paragraph 2.

What it reaches

Obligation class

Consent, Contract terms, Security, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 2 applies this Law to personal data processed using automation tools, or without automation tools where the data can be searched or accessed by specific criteria, and Article 2 excludes an individual's purely personal, family or household activity and data classified as a state secret.

Article 4 requires processing to be proportionate to its stated purposes, based on the personal data subject's consent except where this Law provides otherwise, limited to explicit, pre declared legitimate purposes, transparent, and no more than necessary, and requires the operator to keep the data accurate and to store it only as long as the stated purposes require.

Article 5 defines that consent as a freely given, unambiguous, informed expression of will, obtainable in writing, as an electronic document, or in another electronic form, with the burden of proving it on the operator.

Article 7 lets an operator entrust processing to an authorized person only under a contract, an act of legislation or a public authority decision that fixes the purposes, the permitted actions, a confidentiality duty and the Article 17 protection measures, and makes the operator responsible to the personal data subject for that person's actions.

Article 17 requires the operator to take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, including appointing a data protection officer or a dedicated unit, publishing a data processing policy, training staff, and implementing technical and cryptographic protection, and a republican public authority operator must publicize on its website the information resources containing personal data it owns.

When LexLint raises it

  • crawls_web
  • trains_models
  • generates_content
  • deploys_chatbot
  • automated_outreach

Read the law

National Center for Personal Data Protection's own English pages (cpd.by), read in full (71,842 characters)
corroborated by e-sud.by practitioner guide

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app