Cybersecurity law & regulation in Belarus (2026)
Cybersecurity in Belarus: sectoral rules.
Belarus operates a multi-instrument cybersecurity regime built across a foundational 2016 Law on Information Security, a 2023 Presidential Decree No. 40 'On Cyber Security' establishing a National Cyber Security Center and sector-level cybersecurity centers, and a 2021 Personal Data Protection Law with mandatory breach notification. The Operational and Analytical Center (OAC) under the President serves as the principal national cybersecurity regulator, overseeing technical standards, incident reporting, and certification of security centers. Critical infrastructure is governed separately through a designated Critical Essential Objects of Informatisation (CEOI) framework with heightened obligations.
Legal framework
Law on Information Security (2016); Presidential Decree No. 40 'On Cyber Security' (2023); Law on Personal Data Protection No. 99-Z (2021); supervised by the Operational and Analytical Center (OAC) under the President of the Republic of Belarus
Key points: cybersecurity in Belarus
Core legislative framework
The Law on Information Security (2016) establishes foundational obligations for all organizations handling information resources, requiring risk assessments, encryption, and incident response protocols. It provides the legal basis for designating Critical Essential Objects of Informatisation (CEOI) and sets out responsibilities of state bodies, organizations, and citizens.
Presidential Decree No. 40 'On Cyber Security' (2023)
Signed in February 2023, Decree No. 40 mandates the creation of a National Cyber Security Center (under the OAC) and sector-level cybersecurity centers across state bodies and major organizations. Hosting providers are explicitly required to implement protective measures under its provisions; the first certified Cyber Security Center was established at the National Traffic Exchange Center in November 2023.
OAC, primary cybersecurity regulator
The Operational and Analytical Center (OAC) under the President, established in 2008, is the central authority for national cybersecurity. It coordinates cyber defense, certifies cybersecurity centers, sets technical protection standards for information systems, and oversees incident reporting. It also regulates the telecommunications market independently.
Incident reporting obligations
Organizations must report information security incidents to the OAC under the procedure established by OAC Order of 2 February 2020 on submitting information about information security events. Hosting providers and operators of critical systems face additional specific reporting obligations under Decree No. 40 and associated implementing orders.
Personal data breach notification (Law 99-Z)
The Law on Personal Data Protection (No. 99-Z, in force 15 November 2021) requires operators to notify the National Personal Data Protection Centre immediately, but no later than three working days after discovering a breach, unless the Centre directs otherwise. Notification is not required if the breach did not result in unlawful dissemination, modification, blocking, or unrecoverable deletion of personal data.
Critical infrastructure (CEOI) protection
Belarus designates Critical Essential Objects of Informatisation (CEOI), information systems whose failure could cause significant harm to national security across political, economic, social, and other domains. CEOI operators must implement a mandated complex of legal, organizational, and technical measures and are subject to heightened OAC oversight, in line with the 2019 Doctrine of Information Security.
Timeline of decisions
- LawAdministrative Code Amended to Introduce Cybersecurity Liability
President Lukashenko signed the Law 'On Amendments to the Codes on Administrative Liability,' establishing explicit administrative penalties for violations of cybersecurity requirements. This strengthened the enforcement layer that intersects with personal-data security obligations under the 2021 PDP Law.
REVERA Law Group
- EnforcementOAC Blocks External Access to Belarusian Websites for 48 Hours
The Operational and Analytical Centre (OAC) restricted access to Belarus-hosted websites from abroad for roughly 48 hours (20:00 March 24, 08:00 March 26), citing a detected threat of destructive cyberspace actions; the blackout coincided with the opposition Day of Will commemoration. This was the first publicly confirmed use of OAC's 2021 network-suspension authority at infrastructure scale.
Telegraf.news
- LawBelarus Signs UN Convention Against Cybercrime (Decree No. 326)
President Lukashenko signed Decree No. 326 authorising the Minister of Internal Affairs to sign the 2024 UN Convention Against Cybercrime, expanding Belarus's international obligations on cross-border data exchange and mutual legal assistance in cyber-investigations.
Reform.news
- Decision · officialBelarus-Russia Union State Information Security Concept Approved
The Supreme State Council of the Union State approved a joint Concept of Information Security for Belarus and Russia, establishing a coordinated policy to protect critical infrastructure and the information space of both states and deepening Russia's role in Belarusian cybersecurity governance.
Ministry of Foreign Affairs of the Republic of Belarus
- Law · officialPresidential Decree No. 40 'On Cyber Security' Enacted
Decree No. 40 created Belarus's formal national cyber-security system, establishing a National Centre for Cyber Security and Incident Response under the OAC, sector-level cyber-security centres for state bodies, and a designated telecom operator for inter-centre coordination, the first comprehensive institutional architecture for cyber defence.
CIS Legislation (official Belarusian decree text)
- LawTelecommunications Law Amended: OAC Empowered to Suspend Internet and Phone Networks
Law No. 109 of 24 May 2021 amended Belarus's telecommunications legislation to formally authorise the OAC to limit or entirely suspend telecom networks and internet access when national security threats are detected; non-compliance by operators constitutes a gross licensing violation.
Arzinger Law Office
- GuidanceOAC Order No. 66: Mandatory Incident Reporting to State Regulator
Order No. 66 of the Operational and Analytical Centre set binding requirements for all owners of information systems to report information-security events and the state of their technical and cryptographic protection to the OAC, establishing Belarus's first formal incident-notification regime.
DataGuidance
- Guidance · officialDoctrine of Information Security of the Republic of Belarus Approved
The Doctrine defined Belarus's conceptual approach to information security, articulating principles of information sovereignty, the protection of critical national infrastructure, and a peaceful foreign information policy, serving as the strategic policy document underpinning subsequent legislation.
Ministry of Foreign Affairs of the Republic of Belarus
- LawPresidential Decree No. 196 on Critical Information Infrastructure Protection
Decree No. 196 'On Certain Measures for Improvement of Information Protection' established criteria for classifying assets as critically important digital infrastructure (social, economic, environmental, or informational significance), required technical and cryptographic protection standards, and created the State Register of Critically Important Digital Assets maintained by the OAC.
Arzinger Law Office
- Law · officialLaw No. 455-Z on Information, Informatisation and Information Protection
The foundational Belarusian information-security statute established the legal framework for information systems, defined categories of protected information, imposed obligations on system owners, and assigned coordination roles to state bodies, remaining the bedrock of the cybersecurity legal regime until supplemented by sector-specific decrees and the 2021 Personal Data Law.
RTI Rating (official Belarusian law text)
Sources
- cis-legislation.com/document.fwx?rgn=147893
- cpd.by/en/national-regulation/the-belarusian-data-protection-act/
- un.mfa.gov.by/docs/doctrine_of_information_security_of_the_republic_of_belarus.pdf
- president.gov.by/en/statebodies/the-operational-and-analysis-center-under-the-presiden
- dlapiperdataprotection.com/index.html?t=breach-notification&c=BY
- cis-legislation.com/document.fwx?rgn=132096
- ncsi.ega.ee/country/by/?allData=1
- en.wikipedia.org/wiki/Operations_and_Analysis_Center_under_the_President_of_the_Republ
- rti-rating.org/wp-content/uploads/2021/06/LAW-OF-THE-REPUBLIC-OF-BELARUS-on-informat
- generisonline.com/an-overview-of-cybersecurity-regulations-in-belarus/
- dataguidance.com/jurisdiction/belarus
Next for Belarus: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026