What Is Law No. 99-Z of 7 May 2021, On Personal Data Protection?
In the 28 August 2026 review, Belarus's operative personal-data framework remains Law No. 99-Z of 7 May 2021, whose substantive provisions entered into force on 15 November 2021. The official National Center identifies it as the governing statute. It was amended by Law No. 175-Z of 1 June 2022 and Law No. 134-Z of 16 March 2026; no repeal or replacement was located. The 2026 amendment is material to complaints: current Article 15 covers unlawful actions, omissions, and decisions of an operator or authorized person, with the Center's decision appealable in court. The Center provides routes for processing information, correction, third-party disclosure information, cessation or deletion, complaints, and compensation for moral harm, subject to statutory exceptions and formal request requirements. The framework is not a dedicated data-broker regime. No data-broker-specific complaint or deletion route located, and no public-record-specific deletion process or registry-removal route located. A generic operator request may be followed by a complaint to the Center, but public availability limits some information and disclosure rights and does not establish a general deletion outcome.
At a glance
- Full name
- Law No. 99-Z of 7 May 2021, On Personal Data Protection
- Short code
- Law No. 99-Z
- Jurisdiction
- Belarus
- Enacted
- 2021
- Last major update
- Amended by Law No. 175-Z of 1 June 2022 and Law No. 134-Z of 16 March 2026; no repeal or replacement was located
- Regulator
- National Center for Personal Data Protection
- Private right of action
- Limited
- Statutory citation
- Law No. 99-Z of 7 May 2021, On Personal Data Protection
Scope, who Law No. 99-Z covers
Protected data
Data subject rights
Right to withdraw consent where consent is the legal basis
Right to obtain information about processing, including the operator, confirmation of processing, the data and source, legal basis, purposes, consent term, and authorized person
Right to correction of incomplete, outdated, or inaccurate data
Right to receive information about disclosures to third parties once per calendar year, free of charge
Right to require cessation of processing and/or deletion where no legal basis remains
Right to complain to the National Center against an operator or authorized person
Right to compensation for moral harm, independently of property loss or other damages
Notable features
The 2026 amendment expressly covers unlawful actions, omissions, and decisions of an operator or authorized person in the complaint framework. Rights requests generally require written or electronic documents identifying the subject, date of birth, relevant identifier or identity-document number, requested action, and signature or qualifying electronic signature. The Center is not itself the body that imposes liability.
Enforcement & penalties
Regulator: National Center for Personal Data Protection
Penalties: Administrative penalties under Article 23.7 of the Administrative Offences Code include up to 50 basic units for intentional unlawful collection, processing, storage, or provision of personal data or violation of related rights; 4-100 basic units where the person learned the data through professional or official duties; up to 200 basic units for intentional unlawful dissemination; and 2-10 basic units for an individual, 10-25 for an individual entrepreneur, or 20-50 for a legal entity for failure to implement protective measures. Criminal liability under Articles 203-1 and 203-2 includes imprisonment, restriction of liberty, arrest, corrective work, disqualification, or fines for specified unlawful collection, provision, dissemination, or negligent security failures. The official materials reviewed do not state the monetary amounts of the criminal fines.
Private right of action: The framework provides compensation for moral harm and a court challenge to a National Center decision. No broader private civil-action route or fixed deadline for a subsequent court challenge was located in the official Center materials reviewed.
Relevance to data brokers
No data-broker-specific complaint or deletion route located. No public-record-specific deletion process or registry-removal route located. A generic written or electronic deletion request to the site owner or operator may be considered within 15 days, followed by a complaint to the Center if ignored or mishandled. The public-availability limitations and any continuing legal basis or retention duty remain material.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
What privacy rights exist in Belarus?+
The framework provides rights to receive processing information, correct data, obtain third-party disclosure information, require cessation or deletion where no legal basis remains, complain to the National Center, challenge its decision in court, and receive compensation for moral harm.
How long does an operator have to respond to a Belarusian privacy request?+
The Center identifies five working days for processing information and 15 days after receipt for consent withdrawal, correction, third-party disclosure information, and cessation or deletion requests.
Can I use a general deletion request against a Belarusian data broker?+
A generic written or electronic request may be made to the site owner or operator, and the Center says it must be considered within 15 days. No data-broker-specific complaint or deletion route located, and deletion may be refused where a valid legal basis or mandatory retention duty remains.
Official sources & citations
Other international privacy regimes
Law No. 99-Z sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: