Data protection & privacy law in Armenia (2026)

Legal framework

Law of the Republic of Armenia on Personal Data Protection (ՀՕ-49-Ն, adopted 18 May 2015, as amended); supervised by the Personal Data Protection Agency (PDPA) under the Ministry of Justice

Key points: data & privacy in Armenia

1. 01Primary Law

   The Law on Personal Data Protection (No. ՀՕ-49-Ն, 18 May 2015) is the principal instrument, covering collection, storage, use, transfer, and deletion of personal data by state bodies, legal entities, and individuals. A revised version entered into force 9 August 2025, introducing stricter purpose limitation, mandatory pseudonymisation for data used outside crime-prevention contexts, and enhanced notice obligations.

   moj.am arlis.am practiceguides.chambers.com

2. 02Supervisory Authority

   The Personal Data Protection Agency (PDPA), operating as a separate subdivision of the Ministry of Justice, is the appointed supervisory body (per Prime Minister Decision N 573-A, 3 July 2015). It maintains the registry of data processors, handles complaints, conducts inspections, and imposes administrative sanctions. It was recognised as a European national data protection authority by the European Conference of Data Protection Authorities in May 2016.

   pdpa.am moj.am moj.am

3. 03Convention 108+ Ratification

   Armenia has been a Party to the Council of Europe Convention 108 since September 2012. On 25 January 2022, Armenia became the first country in the world to ratify the modernised Protocol amending Convention 108 (Convention 108+), reinforcing its commitment to internationally recognised data protection standards.

   coe.int coe.int

4. 04Data Subject Rights & Key Obligations

   The law grants data subjects rights to access, rectify, and erase personal data. Controllers must process data lawfully, for specified purposes only, and collect no more data than necessary (proportionality/data minimisation). Consent is a primary lawful basis, and special categories of data (biometric, health, etc.) require PDPA notification before processing.

   dlapiperdataprotection.com chambers.com

5. 05Enforcement & Penalties

   The PDPA initiated its first administrative enforcement action in 2023. Administrative fines currently range from 50,000 to 500,000 AMD (approximately USD 130-1,300), widely considered low. The agency is significantly under-resourced with only 7-8 staff, and strengthening its independence and enforcement capacity is flagged as a priority in the EU-Armenia CEPA Implementation Roadmap.

   practiceguides.chambers.com araminta-advisers.eu

6. 06GDPR Alignment & Ongoing Reform

   Armenia is not an EU member but has progressively aligned its data protection framework with GDPR principles through successive amendments, partly driven by its EU Comprehensive and Enhanced Partnership Agreement (CEPA). Remaining gaps identified include PDPA structural independence, adequacy of sanctions, and clarity of controller/processor distinctions. A draft Cybersecurity Law pending as of early 2025 may introduce additional data-security requirements.

   legal500.com dataguidance.com practiceguides.chambers.com

Timeline of decisions

1. 8 Jul 2024Guidance · official
   PDPA Publishes Updated Adequacy List (53 States)

   The Personal Data Protection Agency published an updated list recognising 53 states as providing an adequate level of personal data protection, giving Armenian controllers a clear legal basis for cross-border data transfers to those countries.

   Personal Data Protection Agency of Armenia

2. 1 Jun 2024Decision
   PDPA Objects to Police Law Surveillance Amendments

   The PDPA joined civil society organisations in formally opposing proposed amendments to the Law on Police that would have expanded police data-collection powers, finding the measures lacked necessity and proportionality analysis and offered insufficient oversight, a significant regulatory pushback on executive surveillance expansion.

   Chambers Data Protection & Privacy 2025 — Armenia

3. 1 Jan 2022Law · official
   Armenia First State to Ratify Modernised Convention 108+ in 2022

   Armenia became the first country to ratify the updated Council of Europe Convention 108+ in 2022 (16th overall), binding itself to GDPR-comparable standards including rules on algorithmic decision-making, data-breach notification, and profiling, a landmark step in alignment with EU data-protection norms.

   Council of Europe — Data Protection

4. 1 Jan 2018Law
   Personal Data Protection Law Amended Toward GDPR Alignment

   Armenia amended its 2015 data protection law to incorporate core GDPR principles including strengthened consent requirements and mandatory breach notification to both the Personal Data Protection Agency and law enforcement; maximum fines remained far below EU equivalents at 500,000 AMD.

   DataGuidance

5. 1 Jul 2015Law · official
   Law on Protection of Personal Data (No. HO-49-N) Enters into Force

   Armenia's principal data-protection statute took effect, establishing GDPR-aligned principles (lawfulness, purpose limitation, data minimisation, security), creating the Personal Data Protection Agency under the Ministry of Justice, and granting data subjects rights of access, correction, and erasure.

   Ministry of Justice of the Republic of Armenia

6. 13 Jun 2015Law · official
   Law on Protection of Personal Data Enacted

   Armenia passed its foundational digital privacy law (No. ZR-49), establishing the Personal Data Protection Agency, defining sensitive data categories, and setting legal bases for online and offline processing, the primary instrument governing personal data collected through digital services.

   ILO NATLEX

7. 18 May 2015Law · official
   National Assembly Adopts Law No. HO-49-N on Protection of Personal Data

   Parliament adopted the new omnibus personal data law, replacing the obsolete 2002 statute. The law covers all processing by state bodies, local governments, organisations, and individuals, and was adopted to align Armenia's framework with modern international standards including Council of Europe requirements.

   ARLIS — Armenian Legal Information System

8. 18 May 2015Law · official
   Law on Protection of Personal Data Enacted

   Armenia enacted its first comprehensive data protection law (No. HO-49-N), establishing principles for lawful data processing, data-subject rights, and a dedicated supervisory authority, forming the foundational legal framework for privacy and data security that underpins all subsequent digital and cybersecurity regulation.

   ILO NATLEX

9. 1 Sept 2012Law · official
   Armenia Becomes Party to Council of Europe Convention 108

   Armenia's ratification of Convention 108, the first binding international data-protection treaty, entered into force, integrating international obligations on automated personal-data processing into domestic law and laying the normative groundwork for the 2015 legislative overhaul.

   Council of Europe — Data Protection: Armenia

Sources

1. 1.moj.am/storage/uploads/Personal_data_protection_law_ENG_OFFICIAL.pdf
2. 2.arlis.am/documentview.aspx?docid=117034
3. 3.pdpa.am/en/agency
4. 4.moj.am/en/article/1550
5. 5.coe.int/en/web/data-protection/-/convention-108-armenia-1st-state-to-ratify-i
6. 6.coe.int/en/web/data-protection/armenia
7. 7.practiceguides.chambers.com/practice-guides/data-protection-privacy-2025/armenia/trends-and-devel
8. 8.dlapiperdataprotection.com/?t=law&c=AM
9. 9.chambers.com/articles/personal-data-protection-in-armenia-key-legal-overview
10. 10.araminta-advisers.eu/wp-content/uploads/2025/12/PDP-policy-brief.pdf
11. 11.legal500.com/guides/chapter/armenia-data-protection-cybersecurity/
12. 12.dataguidance.com/notes/armenia-data-protection-overview
13. 13.moj.am/en/structures/view/structure/32