Belarus

Article 16 requires the operator to notify the authorized agency for the protection of personal data subjects' rights of a violation of personal data protection systems immediately, and no later than three working days after the operator became aware of it, except as the agency itself otherwise provides. This Law states no separate duty to notify an affected personal data subject of the violation, and no content requirements for the notification to the agency beyond the deadline itself.

Article 2 applies this Law to personal data processed using automation tools, or without automation tools where the data can be searched or accessed by specific criteria, and Article 2 excludes an individual's purely personal, family or household activity and data classified as a state secret.

Article 4 requires processing to be proportionate to its stated purposes, based on the personal data subject's consent except where this Law provides otherwise, limited to explicit, pre declared legitimate purposes, transparent, and no more than necessary, and requires the operator to keep the data accurate and to store it only as long as the stated purposes require.

Article 5 defines that consent as a freely given, unambiguous, informed expression of will, obtainable in writing, as an electronic document, or in another electronic form, with the burden of proving it on the operator.

Article 7 lets an operator entrust processing to an authorized person only under a contract, an act of legislation or a public authority decision that fixes the purposes, the permitted actions, a confidentiality duty and the Article 17 protection measures, and makes the operator responsible to the personal data subject for that person's actions.

Article 17 requires the operator to take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, including appointing a data protection officer or a dedicated unit, publishing a data processing policy, training staff, and implementing technical and cryptographic protection, and a republican public authority operator must publicize on its website the information resources containing personal data it owns.

Article 9 prohibits cross-border transfer of personal data where an adequate level of protection of personal data subjects' rights is not provided in the destination country, unless one of seven listed exceptions applies, including the personal data subject's informed consent to the risks, performance of a contract with the subject, a transfer the subject could obtain by request under legislation, protecting vital interests where consent cannot be obtained, execution of a Belarusian treaty, financial monitoring against money laundering or terrorist financing, or a permit from the authorized agency.

Article 9 also gives the authorized agency for the protection of personal data subjects' rights the power to determine the list of foreign countries whose territory ensures an appropriate level of protection, so an operator transferring to a country outside that list needs one of the other Article 9 exceptions or the agency's own permit.

Article 10 lets a personal data subject withdraw consent at any time without giving reasons, and requires the operator, within fifteen days and absent another legal basis, to stop processing, erase the data and notify the subject, or where erasure is not technically possible to restrict further processing and notify the subject instead.

Article 11 gives a personal data subject the right to receive information on the processing of his or her personal data, including the operator's identity, confirmation of processing, the data and its source, and the legal basis and purposes, which the operator must provide within five working days or explain why it is refused, and gives the right to require rectification of personal data that are incomplete, outdated or inaccurate.

Article 12 gives a personal data subject the right to receive, once a calendar year and free of charge, information from the operator about the transmission of his or her personal data to third parties. Article 13 gives a personal data subject the right to demand the free termination of processing, including erasure, absent a legal basis for it, which the operator must carry out within fifteen days, or, where erasure is not technically possible, restrict further processing instead.

Article 14 requires a personal data subject exercising the Articles 10 to 13 rights to submit a written or electronic application to the operator, and requires the operator's response to match the form of that application unless the subject asks otherwise.

Article 15 lets a personal data subject appeal an operator's actions, inaction or decisions that violate their rights to the authorized agency in the manner legislation on citizens' and legal persons' appeals prescribes, and lets the agency's decision be further appealed to a court. Article 16 requires an operator to fulfill the agency's other requirements to eliminate data protection legislation violations.

Article 18 sets up the authorized agency, gives it control over operators' processing, complaint handling, and the power to require an operator to rectify, restrict or erase false or illegally obtained personal data and eliminate other violations of this Law, and requires it to publish an annual activity report by 15 March.

Article 19 makes a person guilty of violating this Law liable under other legislative acts, and entitles a personal data subject to compensation for moral damage caused by a violation of their rights under this Law, independent of any compensation for property damage.

Article 1 defines special personal data as personal data related to race or nationality, political opinions, trade union membership, religious or other beliefs, sex life or health, administrative or criminal records, and biometric and genetic personal data, with biometric personal data itself defined as information characterizing the physiological and biological particularities of an individual used for unique identification, naming fingerprints, palmprints, iris, and face features and their image as examples.

This definition is not confined to a directly captured biometric template, and reaches an image from which those features can be read.

Article 8 prohibits processing special personal data without the personal data subject's consent, except in the listed cases, including where the personal data subject has made the special personal data publicly disclosed himself, for labor relations, for medical care by a professional bound to patient confidentiality, for the administration of justice, or for national security, anti corruption or anti money laundering purposes, and permits processing in those cases only where a set of measures against the risks it poses to personal data subjects' rights and freedoms has been adopted.

Article 349(1) punishes unauthorized access to computer information accompanied by a breach of a protection system, committed for gain or negligently causing substantial harm, with a fine, disqualification from certain positions or activity, arrest, restriction of freedom for up to two years, or deprivation of freedom for the same term; article 349(2) raises the penalty to restriction of freedom for up to five years or deprivation of freedom for up to seven years where the same conduct negligently causes a crash, accident, casualties, or other grave consequences.

Article 352(1) separately punishes intentional unauthorized copying, interception, or other unlawful acquisition of computer information causing substantial harm, without requiring a breach of a protection system, at up to three years' restriction of freedom or two years' deprivation of freedom.

Article 354 punishes developing, using, distributing, or selling a computer program or device known to be intended for defeating a protection system or for unauthorized access, destruction, blocking, or modification of computer information, and article 355 punishes a person with lawful access who negligently breaches computer-system operating rules and thereby causes substantial harm.

Because articles 349(1) and 352(1) require a breach of a protection system, a corrupt purpose, or a resulting harm, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of these provisions.

Article 14 protects a database as a compilation work, and expressly states that this protection does not extend to the data or other information the database contains, so Belarus's database right is compilation-only rather than a sui generis right in the underlying data.

The Law's free-use chapter (arts. 32 to 39) has no text-and-data-mining exception or reservation mechanism; article 39 lets a person who lawfully possesses a copy of a computer program or database copy it only for archival purposes or to replace a lost, destroyed, or unusable lawfully acquired copy, not to build a training corpus.

Using a copyrighted database's compilation structure, or another protected work, to train an AI model therefore ordinarily requires the rightsholder's authorization unless one of the Law's other free-use grounds, such as quotation for research or informational purposes, applies. A rightsholder may sue for infringement and elect statutory compensation instead of proving actual loss.

Illegal distribution or use of a protected work committed after a prior administrative penalty for the same conduct, or that yields a large gain, is also a criminal offence under the Criminal Code.

Article 40 of Law No. 455-Z of 10 November 2008 On Information, Informatization and Protection of Information obliges an information system operator to ensure the integrity and safety of information contained in its information system.

The same article also requires the operator to take measures preventing the disclosure, loss, distortion, destruction, or unauthorized modification of that information and the blocking of legitimate access to it, and, where necessary, to take measures to restore lost information. Article 1 defines an information system operator as any subject of information relations that operates an information system or provides information services through it.

Article 5 lists legal entities and individual entrepreneurs among the subjects of information relations the Law reaches, so the duty binds a private-sector operator rather than only a state body. The duty carries no personal-data trigger, sector gate, or size threshold, and it applies to whatever information the operator's system contains.

That is a stricter reading than article 31's parallel information-holder duty in the same chapter, which the Law itself qualifies to apply only in cases established by the legislation of the Republic of Belarus, a qualifier article 40's own obligation does not carry.

Article 41 makes a bare cross-reference to unspecified legislative acts of the Republic of Belarus for the liability that attaches to a violation, without stating a penalty amount, an enforcement body, or a specific offense for this duty within the Law's own text.

Article 44 sets commencement at six months after official publication of the Law, and the exact calendar date is not confirmed from a primary source here; the Law's own amendment history, most recently in 2016, establishes that it is currently in force regardless of that unconfirmed date.

Article 32(2) permits reproducing excerpts of a lawfully published work, in the original or in translation, as quotation for research, educational, polemical, critical, or informational purposes, to the extent the purpose justifies.

Article 33(1) separately permits reproducing, in a print outlet, broadcasting, or communicating to the public by another means, a lawfully published newspaper or magazine article on current economic, political, social, or religious affairs, or a work of the same character lawfully broadcast or lawfully placed for public information on the global computer network Internet, unless the author or other rightsholder has specially prohibited such use.

Article 33(2) allows the same for publicly delivered political speeches, addresses, and reports, to the extent justified by an informational purpose, and article 33(3) allows reproducing works seen or heard during a current event, as part of a review of that event, to the same extent.

None of these provisions carries a headline-length or short-extract cap distinct from its own purpose-justified or reservation test, and no reported Belarusian decision applies any of them to a systematic online news aggregator rather than an individual quoting or reprinting a published work.