Data & Privacy · Belarus
Data protection & privacy laws in Belarus (2026)
Belarus shaded by its data & privacy status
Belarus enacted its first standalone, comprehensive personal data protection law (Law No. 99-Z) in May 2021, which came into force in November 2021. The law is broadly modelled on the GDPR, introducing operator/authorised-party concepts analogous to controller/processor, a full suite of data-subject rights, mandatory DPO appointment for legal entities and public bodies, breach notification obligations, and cross-border transfer rules. The National Personal Data Protection Center (NPDPC) is the independent supervisory authority empowered to audit compliance, issue binding prescriptions, and order cessation of unlawful processing.
Key points
Law No. 99-Z 'On Personal Data Protection' of 7 May 2021 entered into force on 15 November 2021 and is the first Belarusian act dedicated exclusively to personal data protection, superseding fragmented provisions in the 2008 Law on Information, Informatization and Protection of Information.
The National Personal Data Protection Center of the Republic of Belarus (NPDPC) is the independent public authority responsible for supervising compliance. It can conduct audits, issue written prescriptions to eliminate violations, and demand termination of unlawful processing.
The law grants rights to information, access, rectification, erasure, objection to automated decision-making, data portability, and consent withdrawal (with erasure within 15 days unless another lawful basis applies). These rights closely mirror GDPR Chapter III.
Belarusian legal entities and public bodies acting as operators must appoint a data protection officer (or dedicated unit), publish internal processing policies, train staff, and implement technical and cryptographic protection measures classified by competent bodies.
Operators must notify the NPDPC of any violation of personal-data protection systems immediately and no later than three working days after discovery — a stricter timeline than the GDPR's 72-hour window from awareness.
Violations carry administrative fines from BYN 1,450 to BYN 5,800, alongside potential civil damages and, for serious cases, criminal liability including corrective work, arrest, or deprivation of the right to hold certain positions.
Belarus - other topics
Last verified 5/24/2026 · Orientation, not legal advice - verify against the primary sources linked above. Explore the full world map →