Cybersecurity regulation in Belarus (2026)

The Operational and Analytical Centre (OAC) restricted access to Belarus-hosted websites from abroad for roughly 48 hours (20:00 March 24 – 08:00 March 26), citing a detected threat of destructive cyberspace actions; the blackout coincided with the opposition Day of Will commemoration. This was the first publicly confirmed use of OAC's 2021 network-suspension authority at infrastructure scale.

President Lukashenko signed Decree No. 326 authorising the Minister of Internal Affairs to sign the 2024 UN Convention Against Cybercrime, expanding Belarus's international obligations on cross-border data exchange and mutual legal assistance in cyber-investigations.

The Supreme State Council of the Union State approved a joint Concept of Information Security for Belarus and Russia, establishing a coordinated policy to protect critical infrastructure and the information space of both states and deepening Russia's role in Belarusian cybersecurity governance.

Decree No. 40 created Belarus's formal national cyber-security system, establishing a National Centre for Cyber Security and Incident Response under the OAC, sector-level cyber-security centres for state bodies, and a designated telecom operator for inter-centre coordination — the first comprehensive institutional architecture for cyber defence.

The Law of 7 May 2021 No. 99-Z — Belarus's first dedicated personal data protection statute — took effect, introducing GDPR-like obligations for data controllers and processors, rights for data subjects, and a National Centre for Personal Data Protection as the supervisory authority.

Law No. 109 of 24 May 2021 amended Belarus's telecommunications legislation to formally authorise the OAC to limit or entirely suspend telecom networks and internet access when national security threats are detected; non-compliance by operators constitutes a gross licensing violation.

On election day the Belarusian government executed a ~61-hour nationwide internet blackout, deploying deep-packet-inspection technology to block SSL traffic, messaging apps and social media; more than 70 websites were subsequently blocked in the weeks that followed — the most severe digital-rights crisis in Belarusian history and a driver of later legislative expansion of OAC powers.

Order No. 66 of the Operational and Analytical Centre set binding requirements for all owners of information systems to report information-security events and the state of their technical and cryptographic protection to the OAC, establishing Belarus's first formal incident-notification regime.

The Doctrine defined Belarus's conceptual approach to information security, articulating principles of information sovereignty, the protection of critical national infrastructure, and a peaceful foreign information policy — serving as the strategic policy document underpinning subsequent legislation.

Decree No. 196 'On Certain Measures for Improvement of Information Protection' established criteria for classifying assets as critically important digital infrastructure (social, economic, environmental, or informational significance), required technical and cryptographic protection standards, and created the State Register of Critically Important Digital Assets maintained by the OAC.

The foundational Belarusian information-security statute established the legal framework for information systems, defined categories of protected information, imposed obligations on system owners, and assigned coordination roles to state bodies — remaining the bedrock of the cybersecurity legal regime until supplemented by sector-specific decrees and the 2021 Personal Data Law.