The operators of personal data in the Republic of Belarus include Belarusian organizations and individual entrepreneurs. Operators are obliged to organize the protection of personal data. Operators are companies and individuals who conduct business and at the same time process personal data of individuals themselves or jointly with other operators. The processing of personal data includes any action with them: collection, systematization, storage, modification, depersonalization, distribution, deletion of personal data, etc.

Each company that processes personal data must create a special department or appoint employees who control the processing of data within the organization.

There is a state body in the Republic of Belarus that checks whether operators comply with the legislation on personal data. This is the National Center for Personal Data Protection (NCPD). Importantly, the NCPD considers complaints regarding the processing of personal data. Such a complaint must be filed within three months from the day when the author of the complaint found out about the violations.

What is the Register of Personal Data Operators

The NCPD will create a state database ”Register of Personal Data Operators“ from January 1, 2024. Consequently, the Register will include information about information resources (systems). With the help of which, in particular, personal data of more than 100 thousand adult individuals and more than 10 thousand individuals under 16 years of age, information about resources for processing biometric and (or) genetic personal data are processed.

Personal data operators need to enter information into the Register no later than January 15, 2024.

This is usually caused by imperfection of the software, intentional actions, or happens from ignorance of the legislation on personal data protection.

Our experienced lawyers can audit the company’s internal documents on personal data issues. If necessary, our experts can develop the necessary documents.

Rights of Individuals Under Data Protection Law

With the new data protection law, customers and users gain strong rights that give them real control over their personal information. They can withdraw consent for data processing at any time, actively managing how their details are handled. They also have the right to know how and why their data is used, letting them make informed choices about their privacy.

Importantly, they can correct inaccurate information to keep records up to date, find out who received their data, and even demand that data be deleted or better secured. Companies handling this data must comply. They’re required to respond to information requests within 5 business days and deliver complete details within 15 days. This new legal framework significantly strengthens individual rights, reflecting the critical role of personal data protection in today’s digital world.

To comply with data protection laws, every organization — including those in finance — must establish clear internal rules for handling personal data. This means preparing essential documents that govern processing activities and, where required, publishing them on the company website or app.

A risk-based approach lets each organization decide which safeguards are needed. Still, the National Personal Data Protection Center requires certain mandatory records, like lists of authorized employees with access to data and registers of IT systems holding personal information.

Two main documents anchor these processes. The Internal Regulation on Personal Data Processing sets rules inside the company, while the Privacy Policy, published online or in the app, informs clients and users. This policy spells out who collects and uses data, what data is processed, for what purposes, and what rights individuals have — along with how they can exercise them.

When data is processed based on consent, the organization must provide clear, separate details about this before processing begins. Simply pointing to a privacy policy isn’t enough; individuals need explicit, standalone information to make informed choices.

Storing Personal Data and Maintaining Records

A core rule of personal data processing is limiting how long data is kept. Personal data should only be stored as long as needed for the purpose it was collected. In Belarus, retention periods are often set by law—like the Ministry of Justice regulation that outlines timelines for financial documents. If the law doesn’t set a period, companies must define one themselves.

Belarusian law (Article 28 of the Constitution) guarantees every person protection from unlawful intrusions into private life, including the privacy of their mail, phone calls, and other communications. With technology rapidly advancing, this principle now extends to personal data, shielding it from unauthorized use or exploitation for commercial or governmental purposes.

A new Belarusian legislative initiative strengthens this by introducing a true “right to be forgotten.” This means individuals will have the legal power to request the deletion or correction of their data from databases, to be informed about how their data is used, and to object to certain types of processing. It marks an important step in giving people real control over their digital footprints.

Personal Data of Children, Relatives, and Deceased Persons

As automated data technologies expand into every part of life, children’s privacy faces new risks. To protect minors, the law requires that personal data of anyone under 16 can only be processed with consent from a parent or legal guardian.

Similarly, handling the personal data of deceased individuals demands careful safeguards. It’s only permitted if the person consented while alive, or if close relatives or heirs give their approval. This ensures sensitive information remains respected and secure, even after death.

Belarusian law sets clear principles for how personal data must be collected, processed, and protected. First, it’s essential to define the purpose—whether hiring staff, sending marketing materials, or managing contracts. This ensures data is only gathered for legitimate, clearly stated reasons.

Next is the scope of data collected. It should strictly match the stated purpose. For instance, there’s no need to request an email address when shipping a product if a name, phone, and delivery address suffice. If the email is needed for marketing, that purpose must be separately specified.

Obtaining consent is another critical requirement, unless the law explicitly allows processing without it. Consent should be clear, specific, and easy to understand—more than a vague notice like “by staying on this site, you accept our policy.” It’s best to have users tick a box confirming they’ve read and agreed to your Privacy Policy.

Before giving consent, individuals must also be informed about your business activities, what data you collect, why you need it, how long you’ll keep it, and how it’s protected. All of this should be laid out in a clear Privacy Policy or Data Processing Policy available to them beforehand.