Skip to content
World Watch

Data protection & privacy law in Belarus (2026)

Data protection in Belarus: comprehensive law.

Belarus enacted its first standalone, comprehensive personal data protection law (Law No. 99-Z) in May 2021, which came into force in November 2021. The law is broadly modelled on the GDPR, introducing operator/authorised-party concepts analogous to controller/processor, a full suite of data-subject rights, mandatory DPO appointment for legal entities and public bodies, breach notification obligations, and cross-border transfer rules. The National Personal Data Protection Center (NPDPC) is the independent supervisory authority empowered to audit compliance, issue binding prescriptions, and order cessation of unlawful processing.

Last verified Official sources first · MethodologyCompare Belarus with other countries

Legal framework

Law of the Republic of Belarus No. 99-Z 'On Personal Data Protection' of 7 May 2021 (in force 15 November 2021), supervised by the National Personal Data Protection Center (NPDPC / cpd.by)

Key points: data & privacy in Belarus

  1. Primary legislation

    Law No. 99-Z 'On Personal Data Protection' of 7 May 2021 entered into force on 15 November 2021 and is the first Belarusian act dedicated exclusively to personal data protection, superseding fragmented provisions in the 2008 Law on Information, Informatization and Protection of Information.

    cpd.by cis-legislation.com

  2. Supervisory authority

    The National Personal Data Protection Center of the Republic of Belarus (NPDPC) is the independent public authority responsible for supervising compliance. It can conduct audits, issue written prescriptions to eliminate violations, and demand termination of unlawful processing.

    cpd.by president.gov.by

  3. Data-subject rights

    The law grants rights to information, access, rectification, erasure, objection to automated decision-making, data portability, and consent withdrawal (with erasure within 15 days unless another lawful basis applies). These rights closely mirror GDPR Chapter III.

    cpd.by dlapiperdataprotection.com

  4. DPO & governance obligations

    Belarusian legal entities and public bodies acting as operators must appoint a data protection officer (or dedicated unit), publish internal processing policies, train staff, and implement technical and cryptographic protection measures classified by competent bodies.

    dataguidance.com e-sud.by

  5. Breach notification

    Operators must notify the NPDPC of any violation of personal-data protection systems immediately and no later than three working days after discovery, a stricter timeline than the GDPR's 72-hour window from awareness.

    cpd.by dlapiperdataprotection.com

  6. Penalties

    Violations carry administrative fines from BYN 1,450 to BYN 5,800, alongside potential civil damages and, for serious cases, criminal liability including corrective work, arrest, or deprivation of the right to hold certain positions.

    e-sud.by dataguidance.com

Timeline of decisions

  1. Law · official
    Law No. 175-Z Amends the Personal Data Protection Act

    Amendments refined implementation details of the 2021 PDP Law and aligned ancillary statutes, including state-registration and population-register legislation, with the new personal-data framework.

    National Center for Personal Data Protection of the Republic of Belarus (cpd.by)

  2. Decision · official
    Presidential Decree No. 422 Establishes the National Center for Personal Data Protection

    Decree No. 422 'On measures to improve the protection of personal data' formally designated the National Center for Personal Data Protection (NPDPC) as Belarus's dedicated supervisory authority, with powers to investigate complaints, conduct operator inspections, issue cross-border transfer permits, and develop data-protection guidance.

    Official Internet Portal of the President of the Republic of Belarus

  3. Law
    Law No. 99-Z on Personal Data Protection Adopted

    Passed by the House of Representatives on 2 April 2021 and approved by the Council of the Republic on 21 April, the law was signed on 7 May 2021, the first Belarusian statute specifically dedicated to personal data, replacing the scattered provisions of the 2008 Information Law.

    CIS Legislation Portal — Law No. 99-Z text

  4. Law
    Constitution of the Republic of Belarus Enshrines Right to Privacy (Article 28)

    Article 28 of the 1994 Constitution guaranteed every person protection against unlawful interference with private life, including correspondence and communications, and assigned the State an obligation to create conditions for personal-data protection, establishing the constitutional foundation for all subsequent privacy legislation.

    University of Minnesota Human Rights Library — Constitution of Belarus

Sources

  1. cpd.by/en/national-regulation/the-belarusian-data-protection-act/
  2. cpd.by/en/about-center/
  3. president.gov.by/en/events/v-belarusi-poyavitsya-nacionalnyy-centr-zashchity-personaln
  4. cis-legislation.com/document.fwx?rgn=132096
  5. dlapiperdataprotection.com/index.html?t=law&c=BY
  6. dataguidance.com/notes/belarus-data-protection-overview
  7. e-sud.by/eng/useful/blog/personal-data-protection-in-belarus

Next for Belarus: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026