Data protection & privacy law in Azerbaijan (2026)

Legal framework

Law of the Republic of Azerbaijan on Personal Data No. 998-IIIQ (adopted 11 May 2010, as amended), supervised by the Ministry of Digital Development and Transport; supplemented by the Law on Information, Informatisation and Protection of Information, the Civil Code and the Code of Administrative Offences.

Key points: data & privacy in Azerbaijan

1. 01Comprehensive law in force

   The Law on Personal Data No. 998-IIIQ of 11 May 2010 is a generally-applicable statute governing the collection and processing of personal data across sectors, and remains the primary in-force framework.

   natlex.ilo.org dlapiperdataprotection.com

2. 02Supervisory authority

   The Ministry of Digital Development and Transport is the supervisory authority; it maintains the state register of personal data information systems, conducts inspections, issues binding instructions and initiates administrative proceedings. There is no separate, fully independent data protection authority of the EU model.

   dataguidance.com en.wikipedia.org

3. 03Terminology differs from GDPR

   The law does not use 'controller' and 'processor'; it instead refers to the 'owner' and 'operator' of personal data, reflecting that it predates and is not fully harmonised with the GDPR.

   dlapiperdataprotection.com caseguard.com

4. 04Registration of personal data information systems

   Creating personal data information resources and systems requires state registration with (and, for certain systems, special permission/licence from) the Ministry; information systems of personal data are subject to mandatory state registration.

   caspianlegalcenter.az vlolawfirm.com

5. 05Cross-border transfer rules

   Transfrontier transfers are permitted where the destination country ensures an adequate level of protection, the data subject gives explicit consent, or the transfer is necessary to perform a contract; transfers threatening national security or public order are prohibited.

   caspianlegalcenter.az vlolawfirm.com

6. 06State surveillance development (MİRAS)

   A Centralized Information and Digital Analytics System (MİRAS), controlled by the State Security Service, is slated to be fully operational by May 2026; rights groups warn it lacks judicial authorisation or independent oversight, raising privacy-protection concerns alongside the formal data-protection regime.

   hrw.org

Timeline of decisions

1. 21 Nov 2025Decision
   Presidential Decree Establishes MİRAS Centralised Digital Surveillance Platform

   President Aliyev signed a decree creating the Centralised Information and Digital Analytics System (MİRAS), controlled by the State Security Service and to be fully operational by May 2026. It consolidates biometrics, health records, communications metadata, and location data from across all government bodies with no independent oversight, drawing condemnation from Human Rights Watch as a vehicle for sweeping privacy violations.

   Human Rights Watch

2. 1 Jan 2025Law
   New Comprehensive Personal Data Protection Law Drafted, GDPR-Aligned Overhaul Pending

   The Electronic Security Service under the Ministry of Digital Development and Transport prepared a wholly new personal data protection law intended to replace the 2010 statute, incorporating GDPR-aligned principles to address data flows from IoT devices, smart city infrastructure, biometrics, and mobile platforms. The Head of the Electronic Security Service announced at CIDC-2025 that the draft was under government review with adoption expected in the near term.

   Report.az

3. 28 Jun 2024Law
   Law on Personal Data (No. 998-IIIQ) Amended

   Azerbaijan's parliament enacted targeted amendments to the core 2010 personal data statute, updating provisions on data collection, processing obligations, and cross-border transfer rules. The amendment is part of an incremental modernisation effort preceding the planned full legislative overhaul.

   Report.az

4. 11 May 2010Law · official
   Law No. 998-IIIQ on Personal Data, foundational data-protection statute

   Azerbaijan enacted its primary personal-data law, establishing data-subject rights (including rights against automated decision-making), written-consent requirements, and criminal penalties of up to seven years' imprisonment for serious breaches; it remains the principal statute governing data processing in AI systems until the planned sector-specific AI law is enacted.

   ILO NATLEX (official text of Law No. 998-IIIQ)

5. 11 May 2010Law · official
   Law on Personal Data (No. 998-IIIQ) Enacted, Primary Data Protection Statute

   Azerbaijan adopted its first comprehensive personal data protection law, establishing legal definitions for data owner and data operator (analogous to GDPR controller/processor), principles of lawfulness, purpose limitation, data minimisation, and accuracy, and granting citizens rights of access, correction, and deletion. The Ministry of Communications and Information Technologies (later Ministry of Digital Development and Transport) was designated as the supervisory authority.

   ILO NATLEX

6. 11 May 2010Law · official
   Law on Personal Data (No. 998-IIIQ) Enacted

   Azerbaijan adopted a dedicated Personal Data Protection Law establishing rules for data collection, processing, and protection, requiring operators to implement organisational and technical safeguards, and restricting cross-border transfers where the recipient country's protections are inadequate. It introduced the first formal data-subject rights framework.

   ILO NATLEX (Law No. 998-IIIQ official text)

7. 13 Jun 2008Law
   Law on Biometric Information Enacted

   Azerbaijan adopted a dedicated statute governing the collection, storage, and use of biometric data, one of the earliest sector-specific data protection instruments in the country. The law established rules for biometric identifiers used in identity documents and established processing restrictions for sensitive biometric records.

   DataGuidance — Azerbaijan Data Protection Overview

8. 3 Apr 1998Law · official
   Law on Information, Informatization and Protection of Information Enacted

   Signed by President Heydar Aliyev, this foundational statute regulated information resources, information systems, and protection of information. It was the first post-Soviet data governance law in Azerbaijan, creating the baseline framework for information security obligations and cross-sector data-processing rules that later underpinned the 2010 personal data law.

   WIPO Lex — Republic of Azerbaijan

9. 12 Nov 1995Law · official
   Constitution of Azerbaijan Adopted, Foundational Privacy Rights Enshrined

   Adopted by popular referendum, Azerbaijan's Constitution established in Article 32 the inviolability of private life and the right to privacy of personal correspondence and communications, and in Article 50 freedom to seek and receive information. These constitutional guarantees form the supreme legal basis upon which all subsequent data protection and privacy legislation is grounded.

   E-Government Portal of Azerbaijan

Sources

1. 1.natlex.ilo.org/dyn/natlex2/natlex2/files/download/86656/AZE-86656.pdf
2. 2.dlapiperdataprotection.com/index.html?t=law&c=AZ
3. 3.dataguidance.com/notes/azerbaijan-data-protection-overview
4. 4.caspianlegalcenter.az/insights/more/personal-data-azerbaijan
5. 5.vlolawfirm.com/tpost/azerbaijan-data-protection
6. 6.en.wikipedia.org/wiki/Ministry_of_Digital_Development_and_Transportation_(Azerbaijan)
7. 7.hrw.org/news/2025/12/15/azerbaijans-surveillance-platform-risks-sweeping-priv
8. 8.caseguard.com/articles/protecting-the-personal-privacy-of-azerbaijani-citizens/