No later than January 15, 2024, personal data operators need to transfer information to the Register of Personal Data Operators. And when the information resource (system) is created after January 1, 2024, the information for inclusion in the Register of Operators must be transferred within 10 days after the start of operation of the information resource (system). However, not all operators need to register in the Register of Personal Data Operators.
Does the company need to submit information to the Register of Personal Data Operators?
A personal data operator is a company (as well as an individual) that processes personal data of individuals. Personal data includes any information that can be used to identify an individual. Usually this is a surname, first name, residential address, passport data, etc.
Not all operators process personal data in such volumes and in such ways as are required for entry into the Register of Personal Data Operators. Individuals, including individual entrepreneurs who are personal data operators, do not need to enter information into the Register of Personal Data Operators.
To determine whether it is necessary to enter information into the Register of Personal Data Operators, it is necessary to analyze the process of processing personal data in the company for compliance with the list of criteria below.
It is necessary to enter information into the Register of Personal Data Operators when:
- The Company is the owner of an information system (resource) containing personal data. An information system is a set of data banks, information technologies and a complex (complexes) of software and hardware; an information resource is an organized set of documented information, including databases and other sets of interrelated information in information systems.
- The Company carries out cross-border transfer of personal data, provided that an adequate level of protection of the rights of personal data subjects is not provided in a foreign country. To determine this criterion, you can use the list of States where an appropriate level of protection of the rights of personal data subjects is provided. There are 57 positions in the list of such states, including Georgia, Lithuania, Latvia, Ukraine, Bulgaria, Belgium, Germany, Poland, etc.
- The company processes biometric and genetic personal data. Biometric personal data includes, in particular, fingerprints, palms, iris, facial characteristics and its image, etc. Genetic personal data includes inherited or acquired genetic characteristics of a person. This is unique information about physiology and health, which is collected, in particular, in the study of biological samples.
- The company processes the personal data of more than 100 thousand individuals.
- The company processes the personal data of more than 10 thousand individuals who have not reached the age of 16.
When a company owns or is the owner of an information resource (system) and the processing of personal data meets one or more criteria from the list, it is necessary to submit information for entry into the Register of Personal Data Operators. The number of individuals whose personal data is processed by the company is determined on the date of entering information into the Register of Personal Data Operators.
What information should be submitted for entry into the Register of Personal Data Operators
When the company has determined that it meets the criteria for submitting information to the Register of Personal Data Operators, the following information should be prepared:
- About the information resource (system): the name of the information resource (system) where the data storage systems and northern equipment are located. If there is, the name of the information system that the resource is included in.
- The purposes and legal grounds for processing personal data and the terms of their storage.
- A list of States where special personal data is transferred to the territory and where their proper level of protection is not provided.
- Statistics: the amount of personal data that is processed at the time of entering information into the Register of Personal Data Operators.
- Information about authorized persons when they process personal data on behalf of the operator or in his interests: name or surname, first name, patronymic, location, registration number in the Unified State Register, if any.
- About the head of a structural unit or an employee who is responsible for internal control over the processing of personal data in the company: surname, first name, patronymic, position and contacts.
You will need to specify this information in the application letter for entering information into the Register of Personal Data Operators. The letter can be sent not only by the personal data operator company. An authorized person can transfer information on behalf of the operator.
How to send information for inclusion in the Register of Personal Data Operators
Information for inclusion in the Register of Personal Data Operators can be sent in one of the following ways:
- In electronic form. To do this, you need to register the user’s personal account and authentication through the State Public Key Management System for Verifying the Electronic Digital Signature of the Republic of Belarus, the Unified Identification System for Individuals and Legal Entities using an electronic digital signature.
- In writing by mail.
- With the help of an interdepartmental document management system.
When it is necessary to submit updated information for inclusion in the Register of Personal Data Operators
When the information that the company indicated in the application letter for entering information into the Register of Personal Data Operators changes, it is necessary to update the information in the Register. To do this, within 10 days after the change, you need to send updated information for inclusion in the Register of the personal data operator. For example, this should be done when the employee responsible for internal control over the processing of personal data or his position and contacts change.
How we can be useful in determining the need to enter information into the Register of Personal Data Operators and interact with the Register
Our lawyers and attorneys are experienced specialists in the field of personal data. We can:
- Advise you on the need to enter information into the Register of Personal Data Operators;
- Conduct an audit of personal data processing processes to determine the need to enter information into the Register of Personal Data Operators;
- Represent your interests when interacting with the Register of Personal Data Operators.
Contact us
If you have any questions about entering information into the Register of Personal Data Operators, we will be happy to help you! Our exceptional experience will help you resolve any situations.
Phone and e-mail communication options are available for your convenience:
- +375293664477 (WhatsApp/Telegram/Viber);
- info@ambylegal.by.
