Azerbaijan

Art. 9.5 enumerates biometric data in detail: fingerprints and palm prints, facial image, iris and retina of the eye, sound fragment and its acoustic parameters, DNA, body-measurement results, description of special features and physical defects of the body, handwriting, signature, and other biometric data, and states that the Act's general processing conditions (Art. 9.1-9.6) are fully applicable to it.

This is a deliberate, textually confirmed choice: biometric data is not elevated to the heightened special-categories regime of Art. 9.7 that governs race, health, and similar categories elsewhere in this same Act, so there is no biometric-specific explicit-consent requirement, no dedicated retention or destruction duty, and no dedicated storage-technology requirement anywhere in this Act.

A service may create and store a voiceprint (the Act's own term is sound fragment and its acoustic parameters) or a faceprint on whatever general basis Art. 9.6 supplies for any other personal data, most plausibly consent for an open category or a legislative basis, and must destroy it only under the Act's general Art. 9.4 duty to destroy data without delay once its processing purpose has been achieved.

A reader should not infer from this instrument's classification alone that Azerbaijan treats biometric data the way this batch's other jurisdictions do; the Act plainly reaches voice and face identifiers, just not as a sensitive category.

Azerbaijan's Law on Personal Data, Law No. 998-IIIQ, signed 11 May 2010 and amended at least five times through 2023, is a compact 19-article statute, the shortest in this batch alongside Armenia's. Lawful bases sit at Art. 9.6: consent for data in an open category, a legislative basis defining purpose and method, fully anonymized scientific or statistical research, or vital-interest necessity, a shorter list than several regional peers'.

Art. 9.5's biometric-data enumeration is subject to these same ordinary lawful bases, not a heightened regime; see the dedicated biometric_privacy instrument. The text relied on here is an NATLEX-hosted English translation with visible machine-translation artifacts, not cross-checked against an official Azerbaijani-language source, though its substance is internally consistent.

Transfer is the default rule under Art. 14.1, prohibited only where it threatens national security (Art. 14.2.1) or the destination country's law does not ensure legal protection at the level determined by the legislation of the Republic of Azerbaijan (Art. 14.2.2).

Art. 14.3 then creates a broad override: with the data subject's consent, or where necessary to protect the subject's life or health, transfer may proceed regardless of the destination's actual level of legal protection, meaning consent fully overrides the adequacy-style standard rather than merely supplementing it.

No standard-contract, binding-corporate-rule, or authority-permit mechanism exists for a non-adequate destination, unlike several regional peers' authority-approval or contract-approval routes; this is a noticeably thinner, more binary regime, coded strict at the jurisdiction level rather than moderate for that reason. No data localization is compelled.

Art. 7 gives a data subject the right to learn whether their data is held, to request the legal justification for its collection, processing, or third-party transfer and the consequences of that transfer, to access the data's content, to know the processing purpose, retention period, methods, and who has access, to demand correction and, subject to statutory exceptions, destruction or archiving instead, to demand a ban on collection or processing, to learn the data's source and demand proof of lawful collection, to demand protection, and to receive information about a system's conformity certificate or state examination.

Art. 7.2 adds a written, substantiated objection right that requires the controller to immediately stop processing on receipt unless processing is legally mandatory, and Art. 7.3 adds a right to object to a decision produced through information-technology processing that harms the subject's interests, triggering either a consent-seeking obligation or an immediate processing halt. Art. 7.4 separately gives a damages right, recorded in the enforcement instrument.

Art. 17 gives a relevant executive authority, not named within this Act itself, power to check compliance of registered information systems, demand information, verify registration filings, demand remedies for violations, and take measures to prosecute violators; which body currently holds that role is not confirmed.

Art. 19 (Liability) is a single sentence: persons guilty of violating this Law shall be held responsible in accordance with the legislation of the Republic of Azerbaijan, a bare reference-out to other, unread law with no fine amounts, penalty tiers, or named enforcement mechanism inside this Act itself, markedly thinner than every other jurisdiction in this batch.

Art. 7.4 gives the data subject a right to complain to the executive authority or the court, and to demand payment of moral and material damage in a court of law, an ordinary proof-of-damage civil remedy rather than a no-proof-of-damage statutory-damages mechanism. Fine amounts a secondary source claims exist in the Administrative Violations Code (300 to 500 AZN, imprisonment up to 7 years) are unconfirmed against primary text and are not stated here as sourced to this Act.

Art. 2.1.6 defines special categories of personal data as data related to a natural person's race or nationality, family life, religious beliefs and convictions, or health or convictions. Biometric data is not included in this list.

Art. 9.7 prohibits processing a special category absent a specific statutory ground; because biometric data sits outside Art. 2.1.6 entirely, it is not subject to this heightened Art. 9.7 regime at all, and is instead governed only by the Act's ordinary general processing conditions (Art. 9.1-9.6), recorded in a separate biometric_privacy instrument.

This instrument's flags deliberately carry no biometric activity flag, since it describes exactly the categories from which Azerbaijan's law excludes biometric data.

Art. 271 punishes intentional access to a computer system, or any part of it, without the right to access it or in violation of its security measures, with the aim of seizing the data stored there or for personal purposes. Art. 272 punishes intentional interception, by technical means, of computer data not intended for general use that is transmitted to, from, or within a computer system, by a person with no right to do so.

Art. 273 punishes intentional damage to, deletion, corruption, modification, or blocking of computer data by an unauthorised person that causes significant damage, and separately punishes seriously obstructing a computer system's operation through the same acts.

Because the Art. 271 offence's trigger is accessing without the right to do so or in violation of a security measure, a person reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Each article carries an aggravated tier for repeated commission, commission by an organised group, or commission by an official abusing their position, and a further tier, carrying imprisonment alone with no fine option, where the act reaches the computer system of a publicly important infrastructure facility.

Art. 17 permits reproducing one copy of a lawfully published work for personal, non-profit use without consent or remuneration, but Art. 17.2 excludes several categories from this allowance, including the reproduction of databases or a substantial part of one, reproduction of computer programs (subject to Art. 24's own exception), and reprographic reproduction of whole books.

Art. 19 permits, without consent or remuneration but with mandatory attribution, short informational quotations and press-review use, and reproducing lawfully published articles on current affairs unless the author has prohibited it, but carries no text-and-data-mining exception for training a model on the reproduced text.

Art. 24 lets a person lawfully possessing computer software or a database modify it, and make an archival or working copy, without the author's consent, but this is a narrow lawful-possessor exception rather than a general mining or scraping right. Art. 44.3(a) separately forbids eliminating a technical protection measure without the right holder's permission.

Art. 47 makes an infringement give rise to civil, administrative, and criminal responsibility under Azerbaijani legislation generally, without stating an amount or naming a specific provision in this Law's own text, and Art. 45.2(2) lets a court award the right holder compensation of 110 to 55,000 manat per case in lieu of proving actual damage or collecting the infringer's income.

Art. 6.1 gives the producer of a compilation of data prepared, verified, and compiled with essential investment a right to prohibit extraction or repeated use of the compilation, or an essential part of it, applying regardless of whether the content is itself copyright-protected (Art. 6.3). Art. 6.2 measures the essential-investment threshold by financial resources or a considerable investment of time and energy, and newness or the data's own value is not required.

The right runs for fifteen years from the year following the compilation's creation, restarting on a substantial new investment (Art. 10). Art. 9 exempts non-commercial personal use by non-electronic means, non-commercial educational or research illustration use, and use for public safety or administrative or legal proceedings, but carries no text-and-data-mining or AI-training exception.

Art. 13.2 separately treats obtaining a protected compilation of data by directly or indirectly cracking the technical security measures used to protect it as illegal use, regardless of whether the compilation is protected by copyright, by this sui generis right, or both.

This Law is amended to 2023 by Law No. 815-VIQD, but the current amended text is available on WIPO Lex only in Azerbaijani; the English translation used here reflects the Law as amended through 2013 and does not confirm the content of the later amendment.

Art. 5.3 creates a category of 'open' personal data: information made public by the data subject, or entered into a resource created for general use, with the subject's consent.

Art. 9.6 lists the lawful bases for collecting and processing personal data, and data of the open category is one of the grounds recognised there alongside the subject's consent to a particular collection, a legislative basis defining the purpose and method of processing, fully anonymised scientific or statistical research, and vital-interest necessity.

Reading Art. 5.3 together with Art. 9.6 supports treating personal data an individual has made public in Azerbaijan, or that sits in a general-use resource with that individual's consent to its being made public, as covered by the open-category ground; no single provision of the Act states this combined conclusion in so many words.

Art. 5.3's open-category definition requires the data to have been made public by the subject or entered into a general-use resource with the subject's own consent; it does not itself say what regime applies to data made public by someone other than the subject, or without the subject's consent, such as a leak or a third party's repost, and no other provision of the Act fills that gap, so such data most plausibly remains subject to the Act's ordinary lawful-basis requirement rather than the narrower open-category ground.

Art. 19(1) of the Copyright and Related Rights Law permits, without the author's or other copyright holder's consent and without paying remuneration, but with mandatory indication of the author's name and the source of borrowing, the use of short excerpts in original or in translation as quotations from lawfully published works, including from newspapers and magazines, to the extent justified by the intended purpose, in the form of press reviews for scientific, research, polemical, critical, and informational purposes.

Art. 19(3) separately permits reproducing in newspapers, magazines, and other periodicals, or publicly performing, lawfully published articles on current economic, political, social, or religious issues, or broadcast works of the same nature, except where the author or other copyright owner has prohibited it. Neither clause carries a headline-length or short-extract cap distinct from its own intended-purpose test.

Art. 17.2 excludes the reproduction of databases or a substantial part of one from the Law's separate personal-use free-reproduction allowance, so bulk, systematic reproduction of a database of articles falls outside that narrower allowance.