BY
Law No. 99-Z on Personal Data Protection Republic of Belarus
Overview
The Law of the Republic of Belarus No. 99-Z on Personal Data Protection sets out the legal framework governing how personal data is collected, used, stored, and otherwise processed in Belarus. It establishes enforceable rights for individuals and defines the responsibilities of public authorities and private organizations that handle personal data. Oversight is carried out by the National Center for Personal Data Protection of the Republic of Belarus.
Adopted on 7 May 2021 and effective from 15 November 2021, the law introduced defined requirements for lawful processing, internal governance, data security safeguards, and cross-border data transfers. Its scope covers both automated processing and non-automated processing where personal data forms part of a structured filing system.
Regulation Summary
- 7 May 2021 – Law No. 99-Z adopted.
- 15 November 2021 – Law entered into force.
- State authorities and public bodies processing personal data.
- Private companies and sole proprietors established in Belarus.
- Foreign organizations processing personal data in Belarus or using equipment located in Belarus.
- Controllers and processors acting on behalf of other entities.
- Personal data processed for purely personal or household purposes.
- Processing related to national security, defense, and operational investigative activities, where separate legislation applies.
- Certain sector-specific activities regulated by other Belarus laws.
Organizations acting as controllers must:
- Rely on a lawful basis for processing, including consent or other legal grounds defined by the law.
- Limit processing to specific and lawful purposes.
- Collect only personal data that is relevant and necessary.
- Implement legal, organizational, and technical measures to protect personal data.
- Appoint a structural unit or designated person responsible for internal control over personal data processing.
- Adopt internal policies governing personal data processing.
Processors must act based on documented instructions from the controller and implement appropriate data protection measures.
Website owners that collect personal data online must:
- Publish a privacy policy describing the identity and contact details of the controller, purposes and legal basis of processing, categories of personal data, recipients or categories of recipients, information on cross-border transfers, retention periods, existence of data subject rights, the right to withdraw consent, and possible consequences of refusing to provide personal data.
- Obtain consent where required before processing personal data through online forms or similar tools.
- Provide a clear method for submitting personal data requests.
- Implement technical safeguards to protect online data transmission.
- Where cookies or similar technologies are used to identify users, transparency and consent requirements may apply depending on the type and purpose of processing.
- Cross-border transfers are permitted where the receiving country provides an adequate level of protection or where other legal safeguards are applied.
- Biometric and other special categories of personal data are subject to stricter conditions.
- Data retention periods must be defined in accordance with Belarus legislation.
Individuals have the right to:
- Receive information about the processing of their personal data.
- Access their personal data.
- Request correction of inaccurate or incomplete data.
- Withdraw consent where processing is based on consent.
- Request termination of processing and deletion where legal grounds exist.
Requests must generally be answered within 15 days unless a different timeframe is established by law.
- Regulatory authority: National Center for Personal Data Protection of the Republic of Belarus.
- Administrative liability is established under the Code of Administrative Offenses of Belarus.
- Fines may reach up to 200 base units for legal entities. One base unit is set annually by the government. If calculated at approximately 40 Belarusian rubles (BYN) per base unit, this may equal up to 8,000 BYN (approximately 2,500 USD), depending on the applicable value at the time of enforcement.
- Authorities may also issue orders requiring remediation of violations.