Use the Lexology Navigator tool to compare the answers in this article with those from other jurisdictions.
Collection and storage of data
Collection and management In what circumstances can personal data be collected, stored and processed? Personal data can be collected, stored and processed provided that:
- written consent is obtained from the personal data subject; and
- certain legal, organisational and technical personal data protection measures are implemented.
Technical personal data protection measures include, in particular, equipping the information systems with information protection systems which use technical and cryptographic means of protection that are certified in accordance with Belarusian law.
If state bodies and legal entities are involved, personal data can be collected, stored and processed on condition that a special department or group of employees is selected to oversee information protection.
Are there any limitations or restrictions on the period for which an organisation may (or must) retain records? No. There are certain restrictions pertaining to employment – for example, employers must retain the personal files of employees for the period of their employment and submit them to an archive where they are stored for 75 years after dismissal.
Do individuals have a right to access personal information about them that is held by an organisation? Belarusian law provides a direct right for individuals to access their personal information held by organisations only in regard to certain data – for example, data from the Population Register or connected with employment (eg, personal files or the labour book).
Do individuals have a right to request deletion of their data? Belarusian law provides no direct right for individuals to request deletion of their data. However, individuals may approach the controlling authority with a notification of wrongdoing if their personal data has been illegally obtained and used.
Consent obligations Is consent required before processing personal data? Yes, the written consent of the data subject is required before processing personal data.
If consent is not provided, are there other circumstances in which data processing is permitted? Under certain circumstances, data processing without consent is permitted by state bodies. In particular, Edict 98 on Improving Transmission of Electronic Messages permits state bodies to process personal data without consent for the purpose of tackling the illegal trafficking and unlicensed supply of telecoms services.
What information must be provided to individuals when personal data is collected? There are no specific requirements regarding what information must be provided to individuals when personal data is collected. However, the collection of personal data – including the purposes of doing so – must comply with Belarusian law.
Data transfer and third parties
Cross-border data transfer What rules govern the transfer of data outside your jurisdiction? No specific rules govern the transfer of data outside Belarus. However, there is a general requirement that personal data can be collected, processed, stored, used and transferred only with the written consent of the individual.
Are there restrictions on the geographic transfer of data? No.
Third parties Do any specific requirements apply to data owners where personal data is transferred to a third party for processing? Personal data can be transferred to a third party for processing with written consent.
Click here to view the full article.