Azerbaijan

Article 148-2 of the Criminal Code makes it an offence to make, without the person's consent, photo, video or audio material that uses that person's image or voice, is made with artificial intelligence technologies or special software and does not reflect reality, or to distribute such material in the media or, where it is shown publicly, on internet information resources or in information-telecommunication networks.

The basic offence is punishable by a fine of 3,000 to 7,000 manat, 360 to 480 hours of community service, restriction of liberty for up to three years or imprisonment for the same period. The same acts committed by a group, against two or more persons, to defame or discredit the person, or against the victim or the victim's close relatives in connection with the victim's official or public duty are punishable by three to five years' imprisonment.

Article 98 of the Constitution provides that a law takes effect on the day it is published unless the law itself states another rule.

Article 242-1 of the Criminal Code makes it an offence to make, without the person's consent, pornographic or sexual photo, video or audio material that uses that person's image or voice and is made with artificial intelligence technologies or special software, or to distribute such material in the media or, where it is shown publicly, on internet information resources or in information-telecommunication networks. The offence is punishable by three to seven years' imprisonment.

Article 98 of the Constitution provides that a law takes effect on the day it is published unless the law itself states another rule.

Article 388-3 of the Code of Administrative Offences penalizes knowingly distributing photo, video or audio material made with artificial intelligence technologies without a clear and easily visible label showing that it was made with them. The offence covers distribution in the media and, where the material is shown publicly, on internet information resources or in information-telecommunication networks. The fine under Article 388-3 is 80 to 150 manat.

The article counts as a label the marking that the artificial intelligence technology used automatically supplies and any visual, audio or text-based marking added to the material. The Cabinet of Ministers was told to propose within two months which body may hear cases under Article 388-3. Article 98 of the Constitution provides that a law takes effect on the day it is published unless the law itself states another rule.

Article 13-2.7 of the Law on Information, Informatization and Protection of Information requires AI-made photo, video or audio material that is shown publicly to carry a clear and easily visible label showing that it was made with such technologies. Article 98 of the Constitution provides that a law takes effect on the day it is published unless the law itself states another rule.

Art. 9.5 enumerates biometric data in detail: fingerprints and palm prints, facial image, iris and retina of the eye, sound fragment and its acoustic parameters, DNA, body-measurement results, description of special features and physical defects of the body, handwriting, signature, and other biometric data, and states that the Act's general processing conditions (Art. 9.1-9.6) are fully applicable to it.

This is a deliberate, textually confirmed choice: biometric data is not elevated to the heightened special-categories regime of Art. 9.7 that governs race, health, and similar categories elsewhere in this same Act, so there is no biometric-specific explicit-consent requirement, no dedicated retention or destruction duty, and no dedicated storage-technology requirement anywhere in this Act.

A service may create and store a voiceprint (the Act's own term is sound fragment and its acoustic parameters) or a faceprint on whatever general basis Art. 9.6 supplies for any other personal data, most plausibly consent for an open category or a legislative basis, and must destroy it only under the Act's general Art. 9.4 duty to destroy data without delay once its processing purpose has been achieved.

A reader should not infer from this instrument's classification alone that Azerbaijan treats biometric data the way this batch's other jurisdictions do; the Act plainly reaches voice and face identifiers, just not as a sensitive category.

Azerbaijan's Law on Personal Data, Law No. 998-IIIQ, signed 11 May 2010 and amended at least five times through 2023, is a compact 19-article statute, the shortest in this batch alongside Armenia's. Lawful bases sit at Art. 9.6: consent for data in an open category, a legislative basis defining purpose and method, fully anonymized scientific or statistical research, or vital-interest necessity, a shorter list than several regional peers'.

Art. 9.5's biometric-data enumeration is subject to these same ordinary lawful bases, not a heightened regime; see the dedicated biometric privacy instrument. The text relied on here is an NATLEX-hosted English translation with visible machine-translation artifacts, not cross-checked against an official Azerbaijani-language source, though its substance is internally consistent.

The purpose of collecting and processing personal data must be clearly declared by the owner or operator, and the collection and processing must correspond to those purposes and to the owner's or operator's material, technical and organizational capabilities. Personal data must be collected only for lawful, predetermined and declared purposes and processed by methods that fit the declared purposes.

The volume and nature of the personal data collected and processed must correspond to the declared purposes and to the powers of the owners. The owner or operator has the right to receive from the subject only the personal data that are necessary to achieve the purposes of processing. Personal data must be accurate and complete and, when necessity arises, updated.

Personal data must be destroyed without delay once the purposes of collecting and processing them have been achieved and the need to keep them has ended.

Transfer is the default rule under Art. 14.1, prohibited only where it threatens national security (Art. 14.2.1) or the destination country's law does not ensure legal protection at the level determined by the legislation of the Republic of Azerbaijan (Art. 14.2.2).

Art. 14.3 then creates a broad override: with the data subject's consent, or where necessary to protect the subject's life or health, transfer may proceed regardless of the destination's actual level of legal protection, meaning consent fully overrides the adequacy-style standard rather than merely supplementing it.

No standard-contract, binding-corporate-rule, or authority-permit mechanism exists for a non-adequate destination, unlike several regional peers' authority-approval or contract-approval routes; this is a noticeably thinner, more binary regime, which is why the jurisdiction reads as strict rather than moderate. No data localization is compelled.

Art. 7 gives a data subject the right to learn whether their data is held, to request the legal justification for its collection, processing, or third-party transfer and the consequences of that transfer, to access the data's content, to know the processing purpose, retention period, methods, and who has access, to demand correction and, subject to statutory exceptions, destruction or archiving instead, to demand a ban on collection or processing, to learn the data's source and demand proof of lawful collection, to demand protection, and to receive information about a system's conformity certificate or state examination.

Art. 7.2 adds a written, substantiated objection right that requires the controller to immediately stop processing on receipt unless processing is legally mandatory, and Art. 7.3 adds a right to object to a decision produced through information-technology processing that harms the subject's interests, triggering either a consent-seeking obligation or an immediate processing halt. Art. 7.4 separately gives a damages right, recorded in the enforcement instrument.

Art. 17 gives a relevant executive authority, not named within this Act itself, power to check compliance of registered information systems, demand information, verify registration filings, demand remedies for violations, and take measures to prosecute violators; which body currently holds that role is not confirmed.

Art. 19 (Liability) is a single sentence: persons guilty of violating this Law shall be held responsible in accordance with the legislation of the Republic of Azerbaijan, a bare reference-out to other, unread law with no fine amounts, penalty tiers, or named enforcement mechanism inside this Act itself, markedly thinner than every other jurisdiction in this batch.

Art. 7.4 gives the data subject a right to complain to the executive authority or the court, and to demand payment of moral and material damage in a court of law, an ordinary proof-of-damage civil remedy rather than a no-proof-of-damage statutory-damages mechanism. Fine amounts a secondary source claims exist in the Administrative Violations Code (300 to 500 AZN, imprisonment up to 7 years) are unconfirmed against primary text and are not stated here as sourced to this Act.

Art. 2.1.6 defines special categories of personal data as data related to a natural person's race or nationality, family life, religious beliefs and convictions, or health or convictions. Biometric data is not included in this list.

Art. 9.7 prohibits processing a special category absent a specific statutory ground; because biometric data sits outside Art. 2.1.6 entirely, it is not subject to this heightened Art. 9.7 regime at all, and is instead governed only by the Act's ordinary general processing conditions (Art. 9.1-9.6), covered in a separate biometric privacy instrument. This instrument therefore covers exactly the categories from which Azerbaijan's law excludes biometric data.

Art. 271 punishes intentional access to a computer system, or any part of it, without the right to access it or in violation of its security measures, with the aim of seizing the data stored there or for personal purposes. Art. 272 punishes intentional interception, by technical means, of computer data not intended for general use that is transmitted to, from, or within a computer system, by a person with no right to do so.

Art. 273 punishes intentional damage to, deletion, corruption, modification, or blocking of computer data by an unauthorised person that causes significant damage, and separately punishes seriously obstructing a computer system's operation through the same acts.

Because the Art. 271 offence's trigger is accessing without the right to do so or in violation of a security measure, a person reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision.

Each article carries an aggravated tier for repeated commission, commission by an organised group, or commission by an official abusing their position, and a further tier, carrying imprisonment alone with no fine option, where the act reaches the computer system of a publicly important infrastructure facility.

Art. 17 permits reproducing one copy of a lawfully published work for personal, non-profit use without consent or remuneration, but Art. 17.2 excludes several categories from this allowance, including the reproduction of databases or a substantial part of one, reproduction of computer programs (subject to Art. 24's own exception), and reprographic reproduction of whole books.

Art. 19 permits, without consent or remuneration but with mandatory attribution, short informational quotations and press-review use, and reproducing lawfully published articles on current affairs unless the author has prohibited it, but carries no text-and-data-mining exception for training a model on the reproduced text.

Art. 24 lets a person lawfully possessing computer software or a database modify it, and make an archival or working copy, without the author's consent, but this is a narrow lawful-possessor exception rather than a general mining or scraping right. Art. 44.3(a) separately forbids eliminating a technical protection measure without the right holder's permission.

Art. 47 makes an infringement give rise to civil, administrative, and criminal responsibility under Azerbaijani legislation generally, without stating an amount or naming a specific provision in this Law's own text, and Art. 45.2(2) lets a court award the right holder compensation of 110 to 55,000 manat per case in lieu of proving actual damage or collecting the infringer's income.

Art. 6.1 gives the producer of a compilation of data prepared, verified, and compiled with essential investment a right to prohibit extraction or repeated use of the compilation, or an essential part of it, applying regardless of whether the content is itself copyright-protected (Art. 6.3). Art. 6.2 measures the essential-investment threshold by financial resources or a considerable investment of time and energy, and newness or the data's own value is not required.

The right runs for fifteen years from the year following the compilation's creation, restarting on a substantial new investment (Art. 10).

Art. 9 lets a lawful user of a database made available to the public extract or reuse an important part of it without the producer's permission when the content is taken by any person for use by non-electronic means, for non-commercial illustration or research in education, or for public safety or administrative or legal proceedings, but carries no text-and-data-mining or AI-training exception.

Art. 13.2 separately treats obtaining a protected compilation of data by directly or indirectly cracking the technical security measures used to protect it as illegal use, regardless of whether the compilation is protected by copyright, by this sui generis right, or both.

The current consolidation, amended up to Law No. 815-VIQD of 17 February 2023, changed only Art. 1.0.10, replacing 'mass media' with 'media' in its second sentence, so each provision described here reads as it did in the 2013 English translation; the current text is published on WIPO Lex in Azerbaijani only, with the 2013 English translation offered for reference.

Art. 5.3 creates a category of 'open' personal data: information made public by the data subject, or entered into a resource created for general use, with the subject's consent.

Art. 9.6 lists the lawful bases for collecting and processing personal data, and data of the open category is one of the grounds recognised there alongside the subject's consent to a particular collection, a legislative basis defining the purpose and method of processing, fully anonymised scientific or statistical research, and vital-interest necessity.

Reading Art. 5.3 together with Art. 9.6 supports treating personal data an individual has made public in Azerbaijan, or that sits in a general-use resource with that individual's consent to its being made public, as covered by the open-category ground; no single provision of the Act states this combined conclusion in so many words.

Art. 5.3's open-category definition requires the data to have been made public by the subject or entered into a general-use resource with the subject's own consent; it does not itself say what regime applies to data made public by someone other than the subject, or without the subject's consent, such as a leak or a third party's repost, and no other provision of the Act fills that gap, so such data most plausibly remains subject to the Act's ordinary lawful-basis requirement rather than the narrower open-category ground.

New article 371-2.1 of the Code of Administrative Offences punishes computer incident response centers, security operations centers and information infrastructure subjects, including owners of internet information resources, internet providers and hosting providers, for failing to take the cybersecurity measures that article 371-2.1 lists.

Article 371-2.1.3 covers failure to answer the authorized body's cybersecurity inquiries within 24 hours, and its digital investigation inquiries within 5 working days. Article 371-2.1.4 covers failure to carry out continuous real-time monitoring of cyber incidents and cyber attacks and the initial technical response to them. Article 371-2.1.5 covers a breach of the general and special cybersecurity requirements for information infrastructure that performs socially significant functions.

The fine for these offences is 500 to 1,000 manat for an official and 1,000 to 2,000 manat for a legal person. The note to article 371-2 excludes critical information infrastructure, state bodies including the Central Bank, intelligence and counterintelligence subjects, and entities supervised in the financial markets. Articles 1.2, 1.3 and 1.5 of the amending Law, which carry article 371-2, apply from 1 July 2027.

Article 2 of Law number 460-IQ, as amended by Law number 539-VIQD of 27 May 2022, defines a critical information infrastructure subject as the owner or user of a critical information infrastructure object, namely a state body, a state-owned legal person, a public legal person created on the state's behalf, or another legal person or individual entrepreneur other than a micro, small or medium-sized enterprise.

Article 20-2.1 treats a system as a critical information infrastructure object where a failure of its functionality could threaten the state's independence, sovereignty, constitutional order, territorial integrity or defense capability, disrupt state bodies or the population's essential supplies, upset economic and financial stability, or upset the ecological balance.

Article 20-3.1 requires each critical information infrastructure subject to organize an information security management system and to keep it operating. Article 20-3.3 requires the subject to appoint a person responsible for critical information infrastructure security and to enter that information in the register of critical information infrastructure objects.

Article 20-6.8 requires the subject to have a cybersecurity service provider carry out an external audit at least once a year and to see that the results reach the body the executive authority designates. Article 20-4.6 provides that a breach of the critical information infrastructure security requirements gives rise to liability established by law.

A Presidential Decree of 5 July 2022 states that it is issued to secure the application of Law number 539-VIQD in connection with that Law's entry into force.

Clause 1.1 of the Rules states that they are issued under article 38.3 of the Law on Banks and set minimum information security requirements for banks operating in Azerbaijan and the local branches of foreign banks. Clause 2 of the approving Decision brings the Rules into force on 1 April 2022. Clause 3.3 requires the bank's Supervisory Board to approve an information security policy drawn up within the bank's risk management strategy and policy.

Clause 3.6 requires the information security policy to be reviewed at least once a year and amended as required. Clause 15.1 requires every bank to keep information security continuous when its information systems and information technologies are damaged, destroyed or endangered. Clause 15.2.2 requires a bank to hold an off-site standby center for the backup and recovery of its information systems, as a measure for continuity of the security of its critical information infrastructure.

New article 371-2.1.2 of the Code of Administrative Offences punishes a failure to submit immediately to the authorized body the information on cyber threats, cyber attacks and cyber incidents directed at information infrastructure, together with the information obtained from the monitoring and initial response that article 371-2.1.4 describes. The same article 371-2.1 fines an official 500 to 1,000 manat and a legal person 1,000 to 2,000 manat. Articles 1.2, 1.3 and 1.5 of the amending Law, which carry article 371-2, apply from 1 July 2027.

Article 20-3.4 requires critical information infrastructure subjects to send information on cyber threats, cyber attacks and cyber incidents against their critical information infrastructure, and on attempts to commit them, to the authorized body in the manner the security requirements set.

Article 2 defines a cyber incident as an event that stops or disrupts the operation of information systems, automated management systems or information-communication networks, or that breaches information security in them. Article 20-4.5 requires the subject to create the conditions for, and give support to, the authorized body's measures against cyber attacks on its critical information infrastructure objects.

A Presidential Decree of 5 July 2022 states that it is issued to secure the application of Law number 539-VIQD in connection with that Law's entry into force.

Clause 14.2 of the Rules requires a bank to submit information on a high-category information security incident to the Central Bank within 5 working days, in the form of Annex 1, confirmed by the Chairman of the Management Board with an enhanced electronic signature and sent through the special-purpose information exchange system. Clause 14.1.6.4.3 ranks an incident as high where, as a result, the bank cannot carry out any business process.

Clause 14.1.6.2 requires a bank to register each incident and to communicate it. Clause 2.1.20 defines an information security incident as one or more unwanted or unexpected information security events that disrupt business processes and are significantly likely to create an information security threat.

The Law bars persons who have not completed 16 years of age from creating an individual digital account on a social network platform that the designated authority lists. The provider must verify a declared age through a request to the user's e-mail address and mobile number and a refundable bank-card debit. The account of a user aged 16 to 18 is managed by a legal representative as to content, advertising and hours of use.

The provider may not keep, pass on or reuse the personal data collected to verify age, and must delete it as soon as the check ends. The Code of Administrative Offences gains Article 388-4, which fines a legal entity 35,000 to 40,000 manat for breaching the safe-use requirements for these platforms, including failing to apply the age-verification methods. The Law enters into force twelve months after the day it is published.

Until the Law enters into force, providers must prepare the technical capacity to determine age and inform the designated authority.

Art. 19(1) of the Copyright and Related Rights Law permits, without the author's or other copyright holder's consent and without paying remuneration, but with mandatory indication of the author's name and the source of borrowing, the use of short excerpts in original or in translation as quotations from lawfully published works, including from newspapers and magazines, to the extent justified by the intended purpose, in the form of press reviews for scientific, research, polemical, critical, and informational purposes.

Art. 19(3) separately permits reproducing in newspapers, magazines, and other periodicals, or publicly performing, lawfully published articles on current economic, political, social, or religious issues, or broadcast works of the same nature, except where the author or other copyright owner has prohibited it. Neither clause carries a headline-length or short-extract cap distinct from its own intended-purpose test.

Art. 17.2 excludes the reproduction of databases or a substantial part of one from the Law's separate personal-use free-reproduction allowance, so bulk, systematic reproduction of a database of articles falls outside that narrower allowance.