Belarus

Article 16 requires the operator to notify the authorized agency for the protection of personal data subjects' rights of a violation of personal data protection systems immediately, and no later than three working days after the operator became aware of it, except as the agency itself otherwise provides. This Law states no separate duty to notify an affected personal data subject of the violation, and no content requirements for the notification to the agency beyond the deadline itself.

Article 2 applies this Law to personal data processed using automation tools, or without automation tools where the data can be searched or accessed by specific criteria, and Article 2 excludes an individual's purely personal, family or household activity and data classified as a state secret.

Article 4 requires processing to be proportionate to its stated purposes, based on the personal data subject's consent except where this Law provides otherwise, limited to explicit, pre declared legitimate purposes, transparent, and no more than necessary, and requires the operator to keep the data accurate and to store it only as long as the stated purposes require.

Article 5 defines that consent as a freely given, unambiguous, informed expression of will, obtainable in writing, as an electronic document, or in another electronic form, with the burden of proving it on the operator.

Article 7 lets an operator entrust processing to an authorized person only under a contract, an act of legislation or a public authority decision that fixes the purposes, the permitted actions, a confidentiality duty and the Article 17 protection measures, and makes the operator responsible to the personal data subject for that person's actions.

Article 17 requires the operator to take legal, organizational and technical measures against unauthorized or accidental access, modification, termination, copying, dissemination, transmission or erasure of personal data, including appointing a data protection officer or a dedicated unit, publishing a data processing policy, training staff, and implementing technical and cryptographic protection, and a republican public authority operator must publicize on its website the information resources containing personal data it owns.

Article 9 prohibits cross-border transfer of personal data where an adequate level of protection of personal data subjects' rights is not provided in the destination country, unless one of seven listed exceptions applies, including the personal data subject's informed consent to the risks, performance of a contract with the subject, a transfer the subject could obtain by request under legislation, protecting vital interests where consent cannot be obtained, execution of a Belarusian treaty, financial monitoring against money laundering or terrorist financing, or a permit from the authorized agency.

Article 9 also gives the authorized agency for the protection of personal data subjects' rights the power to determine the list of foreign countries whose territory ensures an appropriate level of protection, so an operator transferring to a country outside that list needs one of the other Article 9 exceptions or the agency's own permit.

Article 10 lets a personal data subject withdraw consent at any time without giving reasons, and requires the operator, within fifteen days and absent another legal basis, to stop processing, erase the data and notify the subject, or where erasure is not technically possible to restrict further processing and notify the subject instead.

Article 11 gives a personal data subject the right to receive information on the processing of his or her personal data, including the operator's identity, confirmation of processing, the data and its source, and the legal basis and purposes, which the operator must provide within five working days or explain why it is refused, and gives the right to require rectification of personal data that are incomplete, outdated or inaccurate.

Article 12 gives a personal data subject the right to receive, once a calendar year and free of charge, information from the operator about the transmission of his or her personal data to third parties. Article 13 gives a personal data subject the right to demand the free termination of processing, including erasure, absent a legal basis for it, which the operator must carry out within fifteen days, or, where erasure is not technically possible, restrict further processing instead.

Article 14 requires a personal data subject exercising the Articles 10 to 13 rights to submit a written or electronic application to the operator, and requires the operator's response to match the form of that application unless the subject asks otherwise.

Article 15 lets a personal data subject appeal an operator's actions, inaction or decisions that violate their rights to the authorized agency in the manner legislation on citizens' and legal persons' appeals prescribes, and lets the agency's decision be further appealed to a court. Article 16 requires an operator to fulfill the agency's other requirements to eliminate data protection legislation violations.

Article 18 sets up the authorized agency, gives it control over operators' processing, complaint handling, and the power to require an operator to rectify, restrict or erase false or illegally obtained personal data and eliminate other violations of this Law, and requires it to publish an annual activity report by 15 March.

Article 19 makes a person guilty of violating this Law liable under other legislative acts, and entitles a personal data subject to compensation for moral damage caused by a violation of their rights under this Law, independent of any compensation for property damage.

Article 1 defines special personal data as personal data related to race or nationality, political opinions, trade union membership, religious or other beliefs, sex life or health, administrative or criminal records, and biometric and genetic personal data, with biometric personal data itself defined as information characterizing the physiological and biological particularities of an individual used for unique identification, naming fingerprints, palmprints, iris, and face features and their image as examples.

This definition is not confined to a directly captured biometric template, and reaches an image from which those features can be read.

Article 8 prohibits processing special personal data without the personal data subject's consent, except in the listed cases, including where the personal data subject has made the special personal data publicly disclosed himself, for labor relations, for medical care by a professional bound to patient confidentiality, for the administration of justice, or for national security, anti corruption or anti money laundering purposes, and permits processing in those cases only where a set of measures against the risks it poses to personal data subjects' rights and freedoms has been adopted.

Article 349(1) punishes unauthorized access to computer information accompanied by a breach of a protection system, committed for gain or negligently causing substantial harm, with a fine, disqualification from certain positions or activity, arrest, restriction of freedom for up to two years, or deprivation of freedom for the same term; article 349(2) raises the penalty to restriction of freedom for up to five years or deprivation of freedom for up to seven years where the same conduct negligently causes a crash, accident, casualties, or other grave consequences.

Article 352(1) separately punishes intentional unauthorized copying, interception, or other unlawful acquisition of computer information causing substantial harm, without requiring a breach of a protection system, at up to three years' restriction of freedom or two years' deprivation of freedom.

Article 354 punishes developing, using, distributing, or selling a computer program or device known to be intended for defeating a protection system or for unauthorized access, destruction, blocking, or modification of computer information, and article 355 punishes a person with lawful access who negligently breaches computer-system operating rules and thereby causes substantial harm.

Because articles 349(1) and 352(1) require a breach of a protection system, a corrupt purpose, or a resulting harm, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of these provisions.

Article 14 protects a database as a compilation work, and expressly states that this protection does not extend to the data or other information the database contains, so Belarus's database right is compilation-only rather than a sui generis right in the underlying data.

The Law's free-use chapter (arts. 32 to 39) has no text-and-data-mining exception or reservation mechanism; article 39 lets a person who lawfully possesses a copy of a computer program or database copy it only for archival purposes or to replace a lost, destroyed, or unusable lawfully acquired copy, not to build a training corpus.

Using a copyrighted database's compilation structure, or another protected work, to train an AI model therefore ordinarily requires the rightsholder's authorization unless one of the Law's other free-use grounds, such as quotation for research or informational purposes, applies. A rightsholder may sue for infringement and elect statutory compensation instead of proving actual loss.

Illegal distribution or use of a protected work committed after a prior administrative penalty for the same conduct, or that yields a large gain, is also a criminal offence under the Criminal Code.

Paragraph 1 of Decree 40 creates the national cybersecurity system, whose elements are the Operational and Analytical Center under the President, the National Cybersecurity Center, the cybersecurity centers of state bodies and other organizations, an authorized telecommunications operator, the information infrastructure objects of those bodies and organizations, and the data networks linking the elements.

Subparagraph 3.4 has the Council of Ministers list, and update every year, the state bodies and other organizations that must create a cybersecurity center or buy cybersecurity services from an organization that has created one.

Subparagraph 3.5 requires the owners of the critically important informatization objects named in Annex 1, and the authorized internet service providers that host official websites and e-mail, to have cybersecurity centers created within one year of that paragraph taking effect. Annex 1 names 27 owners of critically important informatization objects, among them banks, insurers, electricity utilities, a nuclear power plant, telecommunications operators and a payment processing center.

Subparagraph 3.7 requires each cybersecurity center to be attested by the Operational and Analytical Center before it starts work and at least once every three years. Subparagraph 3.12 requires state bodies and other organizations to keep information on cyber incidents at their information infrastructure objects for at least one year.

Subparagraph 3.14 makes the head of a state body or other organization personally responsible for its cybersecurity, and subparagraph 3.15 has the head name a deputy responsible for organizing that work. Subparagraph 3.1 lets the Operational and Analytical Center issue orders, binding on state bodies and other organizations, to remedy violations of the Decree and of the cybersecurity requirements for their information infrastructure objects. Paragraph 8 brings paragraphs 1 to 5 into force six months after the Decree's official publication.

Article 40 of Law No. 455-Z of 10 November 2008 On Information, Informatization and Protection of Information obliges an information system operator to ensure the integrity and safety of information contained in its information system.

The same article also requires the operator to take measures preventing the disclosure, loss, distortion, destruction, or unauthorized modification of that information and the blocking of legitimate access to it, and, where necessary, to take measures to restore lost information. Article 1 defines an information system operator as any subject of information relations that operates an information system or provides information services through it.

Article 5 lists legal entities and individual entrepreneurs among the subjects of information relations the Law reaches, so the duty binds a private-sector operator rather than only a state body. The duty carries no personal-data trigger, sector gate, or size threshold, and it applies to whatever information the operator's system contains.

That is a stricter reading than article 31's parallel information-holder duty in the same chapter, which the Law itself qualifies to apply only in cases established by the legislation of the Republic of Belarus, a qualifier article 40's own obligation does not carry.

Article 41 makes a bare cross-reference to unspecified legislative acts of the Republic of Belarus for the liability that attaches to a violation, without stating a penalty amount, an enforcement body, or a specific offense for this duty within the Law's own text. Article 44 provides that the Law enters into force six months after its official publication, and no official source stating the resulting calendar day has been located.

Subparagraph 3.8 requires cybersecurity centers to inform the National Cybersecurity Center of identified cyber incidents no later than one hour after identifying them, and to provide other information, including the results of response and clean-up, in the order, scope and time limits the Operational and Analytical Center sets.

Subparagraph 3.3 entitles the authorized persons of the National Cybersecurity Center to demand from state bodies and other organizations documents and other information, including technical information, about their information infrastructure objects, to be provided no later than the day after the demand. Subparagraph 3.2 creates the national cyber incident response team CERT.BY inside the National Cybersecurity Center.

Annex 2 defines a cyber incident as an event that actually or potentially threatens the confidentiality, integrity, authenticity, availability and safety of information and that breaches or threatens to breach the security policy.

Article 32(2) permits reproducing excerpts of a lawfully published work, in the original or in translation, as quotation for research, educational, polemical, critical, or informational purposes, to the extent the purpose justifies.

Article 33(1) separately permits reproducing, in a print outlet, broadcasting, or communicating to the public by another means, a lawfully published newspaper or magazine article on current economic, political, social, or religious affairs, or a work of the same character lawfully broadcast or lawfully placed for public information on the global computer network Internet, unless the author or other rightsholder has specially prohibited such use.

Article 33(2) allows the same for publicly delivered political speeches, addresses, and reports, to the extent justified by an informational purpose, and article 33(3) allows reproducing works seen or heard during a current event, as part of a review of that event, to the same extent.

None of these provisions carries a headline-length or short-extract cap distinct from its own purpose-justified or reservation test, and no reported Belarusian decision applies any of them to a systematic online news aggregator rather than an individual quoting or reprinting a published work.