Data protection & privacy law in Azerbaijan (2026)

The Electronic Security Service under the Ministry of Digital Development and Transport prepared a wholly new personal data protection law intended to replace the 2010 statute, incorporating GDPR-aligned principles to address data flows from IoT devices, smart city infrastructure, biometrics, and mobile platforms. The Head of the Electronic Security Service announced at CIDC-2025 that the draft was under government review with adoption expected in the near term.

Azerbaijan's parliament enacted targeted amendments to the core 2010 personal data statute, updating provisions on data collection, processing obligations, and cross-border transfer rules. The amendment is part of an incremental modernisation effort preceding the planned full legislative overhaul.

Amendments to the Law on Information, Informatization and Protection of Information (adopted 27 May 2022, effective 6 July 2022) introduced legally binding definitions for cyber attack, cyber incident, and critical information infrastructure, and added Chapter V-I imposing mandatory security requirements on operators of critical systems. Corresponding Administrative Offences Code amendments established penalties for non-compliance.

President Ilham Aliyev signed a decree establishing state measures to secure critical information infrastructure and assigning oversight responsibilities to the Electronic Security Service (CERT.AZ). The decree provided the policy mandate that drove the 2022 legislative amendments.

Azerbaijan adopted its first comprehensive personal data protection law, establishing legal definitions for data owner and data operator (analogous to GDPR controller/processor), principles of lawfulness, purpose limitation, data minimisation, and accuracy, and granting citizens rights of access, correction, and deletion. The Ministry of Communications and Information Technologies (later Ministry of Digital Development and Transport) was designated as the supervisory authority.

Azerbaijan adopted a dedicated statute governing the collection, storage, and use of biometric data, one of the earliest sector-specific data protection instruments in the country. The law established rules for biometric identifiers used in identity documents and established processing restrictions for sensitive biometric records.

This statute guaranteed citizens' right to request and receive information held by public authorities and established proactive disclosure obligations. It built the complementary transparency framework alongside the evolving data protection regime, and set limits on withholding personal or third-party data from public records.

Signed by President Heydar Aliyev, this foundational statute regulated information resources, information systems, and protection of information. It was the first post-Soviet data governance law in Azerbaijan, creating the baseline framework for information security obligations and cross-sector data-processing rules that later underpinned the 2010 personal data law.

Adopted by popular referendum, Azerbaijan's Constitution established in Article 32 the inviolability of private life and the right to privacy of personal correspondence and communications, and in Article 50 freedom to seek and receive information. These constitutional guarantees form the supreme legal basis upon which all subsequent data protection and privacy legislation is grounded.