Belarus. Comprehensive data protection. Act
Law 99-ZLaw of the Republic of Belarus No. 99-Z of 7 May 2021 'On Personal Data Protection'
In force
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Belarus's first dedicated data protection law, setting consent-based processing, data subject rights, mandatory internal control, breach notification and restrictions on transfers abroad.
- Key themes
- Unique features
Breach notice within three business days; non-outsourceable internal control function with mandatory training; transfers to non-adequate states need consent or an NPDPC permit.
- SaaS relevance
Applies to SaaS providers processing data of people in Belarus; transfers out require adequacy, consent or a permit.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- NPDPC immediately, no later than 3 business days
- DPO
- Yes
- Cross-border transfers
- Adequacy list (CoE Convention 108 parties, EAEU) or consent/NPDPC permit
- Maximum penalty
- Administrative fines up to 200 base units; criminal liability up to 3 years' restriction/deprivation of liberty
§3Dates
- Key dates
- Adopted
- In force
- Draft amendments planned for 2026 (not published as of February 2026)
§4Text and authority
- Text
- Authoritative text pravo.by
- Authority
- National Personal Data Protection Centre (NPDPC)
§5Where it applies
- Domestic law of
- Belarus
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.