The Belarusian Data Protection Act

This Law is aimed to ensure personal data protection, to protect the human rights and freedoms of individuals in the processing of their personal data.

CHAPTER 1
GENERAL PROVISIONS

Article 1. Main terms used in this Law and their definitions

The following main terms and their definitions are used in this Law:
biometric personal data – information characterizing the physiological and biological particularities of an individual, which is used for unique identification of that person (fingerprints, palmprints, iris, face features and its image, etc.);

restriction of personal data – termination of access to personal data without their erasure;

genetic personal data – information relating to the inherited or acquired genetic characteristics of an individual, which contain unique data about his or her physiology or health and can be identified, in particular, by examining his or her biological sample;

pseudonymization of personal data – actions, as a result of which it becomes impossible, without the use of additional information, to determine the attribution of personal data to a specific personal data subject;

processing of personal data – any operation or set of operations which are performed on personal data, including the collection, structuring, storage, alteration, use, pseudonymization, restriction, disclosure by transmission, dissemination, erasure;

publicly disclosed personal data – personal data disseminated by the personal data subject, or with his or her consent, or disseminated in accordance with legislative acts;

operator – a public authority, a legal person of the Republic of Belarus, another organization, an individual, including an individual entrepreneur (hereinafter, unless otherwise specified, referred to as an individual), independently or jointly with other specified persons organizing and/or carrying out the processing of personal data;

personal data – any information relating to an identified or identifiable individual;

transmission of personal data – actions aimed at familiarizing a certain individual or a group of individuals with the personal data;

dissemination of personal data – actions aimed at familiarizing an indefinite group of individuals with the personal data;

special personal data – personal data related to race or nationality, political opinions, trade-union membership, religious or other beliefs, sex life or health, administrative or criminal records, as well as biometric and genetic personal data;

personal data subject – an individual in respect of whom personal data are processed;

cross-border transfer of personal data – the transfer of personal data to the territory of a foreign country;

erasure of personal data – actions causing the inability to restore personal data in information resources (systems) containing personal data, and/or destruction of personal data storage media;

authorized person – a public authority, a legal person of the Republic of Belarus, another organization, an individual which processes personal data on behalf of the operator or in its interests based on an act of legislation, a public authority decision, a contract with an operator

identifiable individual – an individual who can be directly or indirectly identified, in particular through a surname, first name, patronymic name, date of birth, identification number, or through one or more factors specific to physical, psychological, mental, economic, cultural, or social identity.

Article 2. Scope of the Law

1. This Law applies to the relations related to the protection of personal data processed:
using automation tools;

without using automation tools, if a search for personal data and/or access to them according to specific criteria (file cabinets, lists, databases, registers, etc.) are provided.

2. This Law does not apply to the processing of personal data:
by individuals in the course of a purely personal, family, household, and other similar activities not related to professional or commercial activities;classified as state secrets in accordance with the established procedure.

Article 3. Legal regulation of relations in the field of personal data processing

1. Relations in the field of personal data processing are regulated by the personal data legislation, as well as treaties of the Republic of Belarus.

2. The personal data legislation is based on the Constitution of the Republic of Belarus and composed of this Law and other acts of legislation.

3. If legislative act establishes the legal regime of legally protected secret which provides specifics of the processing of personal data that are part of legally protected secrets, the provisions of such act shall apply.

4. If a treaty of the Republic of Belarus establishes other rules than those contained in this Law, the rules of the treaty shall apply.

CHAPTER 2
PROCESSING OF PERSONAL DATA

Article 4. General requirements for the processing of personal data

1. The processing of personal data is carried out in accordance with this Law and other acts of legislation.

2. The processing of personal data must be proportionate to the stated purposes of their processing and ensure a fair balance of all concerned persons’ interests at all processing stages.

3. The processing of personal data is carried out based on the consent of the personal data subject, except in cases provided for by this Law and other legislative acts.
In the case of processing personal data without the consent of the personal data subject, the purposes of processing personal data are established by this Law and other legislative acts.

4. The processing of personal data must be limited to the achievement of explicit, pre-declared legitimate purposes. Processing of personal data, incompatible with the originally stated purposes of their processing, is not allowed.
If it is necessary to change the originally stated purposes of the processing of personal data, the operator is obliged to obtain the consent of the personal data subject to the processing of his or her personal data (hereinafter – the consent of the personal data subject) in accordance with changed purposes of the processing of personal data in the absence of other basis for the processing provided for by this Law and other legislative acts.

5. The content and volume of processed personal data must correspond to the stated purposes of their processing. Processed personal data must not be excessive in relation to the stated purposes of their processing.

6. The processing of personal data must be transparent. For this purpose, the personal data subject, in cases provided by this Law, is provided with relevant information regarding processing of his or her personal data.

7. The operator is obliged to take measures to ensure the accuracy of the processed personal data, if necessary, to update them.

8. The storage of personal data must be carried out in the form that allows to identify the personal data subject no longer than the stated purposes of the processing of personal data require.

Article 5. The consent of the personal data subject

1. The consent of the personal data subject is a freely given, unambiguous, informed expression of his or her will, by which he or she authorizes the processing of his or her personal data.

2. The consent of the personal data subject can be obtained in writing form, as an electronic document or in another electronic form.

3. The consent of the personal data subject can be obtained in other electronic form through:
specification (selection) by the personal data subject of certain information (code) after receiving a text message via Short Message Service, e-mail address;putting by the personal data subject an appropriate mark on the Internet resource;
other ways, allowing to establish the fact of obtaining the consent of the personal data subject.

4. Legislative acts may establish the need to obtain the consent of the subject of personal data only in writing form or in the form of an electronic document.

5. The operator before obtaining the consent of the personal data subject, is obliged to provide the personal data subject with information in writing or electronic form, corresponding to the form of expressing the consent containing:
name (surname, first name, patronymic name (if any)) and location (address of residence (place of stay)) of the operator receiving the consent of the personal data subject;
purposes of the processing of personal data;
the list of personal data processed on the basis of the consent;
the period for which the consent of the personal data subject is valid;
information about the authorized persons in the case of personal data processing by such persons;
the list of actions with personal data, for which the consent of the personal data subject is given, a general description of the methods used by the operator for the processing of personal data;
other information necessary to ensure transparency of the processing of personal data.
The operator before obtaining the consent of the personal data subject, is obliged to explain in a simple and clear language to the personal data subject his or her rights related to the processing of personal data, the mechanism for exercising such rights, as well as the consequences of giving the consent of the personal data subject or refusing of giving such consent. This information must be provided by the operator to a personal data subject in written or electronic form, corresponding to the form of expressing his or her consent, separately from other information provided to him or her.

6. The personal data subject, when giving his or her consent to the operator, indicates his or her surname, first name, patronymic name (if any), date of birth, identification number, and in the absence of such number – the identity document number, except for the case provided for in part two of this paragraph.
If the purposes of the processing of personal data do not require the processing of information specified in part one of this paragraph, this information is not subject to the processing by the operator upon obtaining the consent of the personal data subject.

7. The obligation to prove that the consent of the personal data subject has been obtained is assigned to the operator.

8. The personal data subject has the right to withdraw his or her consent in accordance with the procedure established by this Law.

9. Upon the death of a personal data subject, declaring him or her to be deceased, the consent to the processing of his or her personal data is given by one of the heirs, close relatives, adoptive parents (adopters), adopted persons or spouse of a personal data subject, if such consent was not given by a personal data subject during his or her lifetime.
In the case where the declaration of the personal data subject is deprived of legal capacity or partially incapacitated, and also before he or she reaches the age of sixteen, except marriage before reaching the age of sixteen, the consent to the processing of his or her personal data is given by one of his or her legal representatives. Legislative acts may provide for different age of juvenile individual, before reaching which the consent to the processing of his or her personal data is given by one of his or her legal representatives.
Persons specified in parts one and two of this paragraph, in case of giving consent to the processing of personal data on behalf of the personal data subject, exercise the rights of the personal data subject provided for by this Law.

Article 6. Processing of personal data without the consent of the personal data subject

The consent of the personal data subject to the processing of personal data, except special personal data, processing procedure for which is established by Article 8 of this Law, is not required:

to conduct administrative and/or criminal proceeding, carrying out law enforcement intelligence operations;
for the implementation of justice, the execution of judicial decrees and other writs of execution;

to exercise control (supervision) in accordance with legislative acts;

for the implementation of norms of legislation in the field of national security, the fight against corruption, the prevention of money laundering, terrorist financing and financing of proliferation of weapons of mass destruction;

for the implementation norms of legislation on election, referendum, recall of a deputy of the House of Representatives, a member of the Council of the Republic of the National Assembly of the Republic of Belarus, a deputy of the local Council of Deputies;

to maintain individual (personified) records of information about insured persons for state social insurance, including occupational pension insurance;

for registration of labor (service) relations, as well as during labor (service) activities of the personal data subject in cases provided for by legislation;

for notarial service;

for consideration of issues related to the citizenship of the Republic of Belarus, granting refugee status, subsidiary protection, asylum, and temporary protection in the Republic of Belarus;
to assign and pay pensions and maintenance allowances;

to organize and conduct state statistical surveys, generate official statistics;

for scientific or other research purposes, subject to the mandatory pseudonymization of personal data;

for accounting, calculating and accruing fees for housing and communal services, fees for the use of residential premises and compensation of electricity costs, fees for other services and compensation of taxes, as well as for providing benefits and collecting debts on fees for housing and communal services, fees for the use of residential premises and compensation of electricity costs;

if operator receives personal data based on the concluded contract (contract being concluded) with a personal data subject, to perform the actions established by this contract;

when processing personal data is indicated in the document addressed to the operator and signed by the personal data subject in accordance with the content of such document;

to carry out legitimate professional activities of a journalist and/or activities of a mass media, organization engaged in publishing activities aimed at protecting the public interest, which is the need of society to detect and disclose information about threats to national security, public order, public health and environment, information affecting the performance of their duties by public officials in a responsible position, public figures, except cases provided for by civil procedural, economic procedural, criminal procedural legislation, legislation determining the procedure for an administrative proceeding;

to protect the life, health or other vital interests of a personal data subject or other persons, if obtaining the consent of the personal data subject is impossible;

for previously disseminated personal data until the personal data subject claims to stop processing disseminated personal data, as well as to erase them in the absence of other legal basis for the processing of personal data provided for by this Law and other legislative acts;

in cases where the processing of personal data is necessary to fulfill the duties (powers) provided for by legislative acts;

in cases where this Law and other legislative acts expressly provide for the processing of personal data without the consent of thepersonal data subject.

Article 7. Processing of personal data on behalf of the operator

1. The authorized person is obliged to comply with requirements for the processing of personal data provided for by this Law and other acts of legislation. The contract between the operator and the authorized person, the act of legislation or the decision of a public authority must define:
the purposes of processing of personal data;
the list of actions that will be performed with personal data by the authorized person;
obligation to respect the confidentiality of personal data;
measures to ensure the protection of personal data in accordance with Article 17 of this Law.

2. The authorized person is not required to obtain the consent of the personal data subject. If the processing of personal data on behalf of the operator requires the consent of the personal data subject, such consent is obtained by the operator.

3. If the operator entrusts the processing of personal data to the authorized person, the operator is responsible to the personal data subject for actions of this person. The authorized person is responsible to the operator.

Article 8. Processing of special personal data

1. Processing of special personal data without the consent of the personal data subject is prohibited, except as provided for in paragraph 2 of this Article.

2. The consent of the personal data subject to the processing of special personal data is not required:
if special personal data are made publicly disclosed personal data by the personal data subject himself;
for registration of labor (service) relations, as well as during labor (service) activities of the personal data subject in cases provided for by legislation;
for the processing by public associations, political parties, trade-unions, religious organizations of the personal data of their founders (members) to achieve the statutory purpose, as long as these data are not subject to the dissemination without the consent of the personal data subject;
to organize the provision of medical care, as long as such personal data are processed by a medical, pharmaceutical, or another healthcare professional who is responsible for ensuring personal data protection and, in accordance with legislation is subject to the obligation to maintain patient confidentiality;
for the implementation of justice, the execution of judicial decrees and other writs of execution, make notary writ, registration of inheritance rights;
to conduct administrative and/or criminal proceeding, carrying out law enforcement intelligence operations;
in cases provided for by the penal enforcement legislation, legislation in the field of national security, on the defense, the fight against corruption, the fight against terrorism and countering extremism, the prevention of money laundering, the financing of terrorist activities and proliferation of weapons of mass destruction, the State Border of the Republic of Belarus, the citizenship, the procedure for leaving the Republic of Belarus and entering the Republic of Belarus, refugee status, subsidiary protection, asylum and temporary protection in the Republic of Belarus;
to ensure the functioning of the unified state system of registration and accounting of offenses;
to conduct forensic records;
for organizing and conducting state statistical surveys, generating official statistics;
to carry out administrative procedures;
in connection with implementation of treaties of the Republic of Belarus on readmission;
for documenting the population;
to protect the life, health or other vital interests of a personal data subject or other persons, if obtaining the consent of the personal data subject is impossible;
in cases where the processing of special personal data is necessary to fulfill the duties (powers) provided for by legislative acts;
in cases where this Law and other legislative acts expressly provide for the processing of special personal data without the consent of the personal data subject.

3. Processing of special personal data is allowed only when it is subject to the adoption of the set of measures aimed at preventing risks that may arise during processing of such personal data for rights and freedoms of personal data subjects.

Article 9. Cross-border transfer of personal data

1. Cross-border transfer of personal data is prohibited, if an adequate level of protection of personal data subjects’ rights is not provided on the territory of a foreign country, except following cases:
the consent of the personal data subject is given, provided informing the personal data subject about the risks arising from the lack of an adequate level of their protection;
personal data were obtained based on the concluded contract (contract being concluded) with a personal data subject, to perform the actions established by this contract;
personal data can be obtained by any person by sending the request in the cases and the manner prescribed by legislation;
the transfer is necessary to protect life, health or other vital interests of a personal data subject or other persons, if obtaining the consent of the personal data subject is impossible;
processing of personal data is carried out within the framework of the execution of treaties of the Republic of Belarus;
the transfer is carried out by the financial monitoring authority to take measures to prevent the money laundering, the financing of terrorist activities and proliferation of weapons of mass destruction in accordance with legislation;
the required permission of the authorized agency for the protection of the personal data subjects’ rights has been received.

2. The authorized agency for the protection of the personal data subjects’ rights determines the list of foreign countries on whose territory an appropriate level of protection of the personal data subjects’ rights is ensured.

CHAPTER 3
RIGHTS OF THE PERSONAL DATA SUBJECT
AND OBLIGATIONS OF THE OPERATOR

Article 10. Right to withdraw the consent of the personal data subject

1. A personal data subject has the right to withdraw his or her consent at any time without giving reasons by applying to the operator in the manner prescribed by Article 14 of this Law, or in the consent form.

2. The operator is obliged, within fifteen days after receiving the application of the personal data subject in accordance with its content, to stop processing of personal data, erase them and notify the personal data subject about it in the absence of a legal basis for the processing of personal data provided for by this Law and other legislative acts.
In the absence of technical ability to erase personal data, the operator is obliged to take measures to prevent further processing of personal data, including their restriction, and notify the personal data subject about it within the same period.

3. The expiration of the contract, which is the basis for the processing of personal data, or its termination entail the consequences referred to in paragraph 2 of this Article unless otherwise provided for by this contract or an act of legislation.

4. The withdrawal of the consent of the personal data subject does not have a retroactive effect, that is, the processing of personal data is not illegal until its termination in accordance with part one of paragraph 2 of this Article.
Print publications, audio or video recordings of programs, radio and television programs, newsreel programs, other information products containing personal data, released before the withdrawal of the consent of the personal data subject are not withdrawal from civil circulation.

Article 11. Right to receive information on the processing of personal data and the rectification of personal data

1. A personal data subject has the right to receive information on the processing of his or her personal data, containing:
name (surname, first name, patronymic name (if any) and location (address of residence (place of stay)) of the operator;
confirmation of the fact of personal data processing by the operator (authorized person);
his or her personal data and the source of their receipt;
legal basis and purposes of personal data processing;
period for which his or her consent is valid;
name and address of the authorized person, which is a public authority, a legal person of the Republic of Belarus, another organization, if processing of personal data is entrusted to such person;
other information provided by legislation.
In order to obtain the information specified in part one of this paragraph, a personal data subject submits an application to the operator in accordance with Article 14 of this Law. At the same time, a personal data subject should not justify his or her interest in the requested information.

2. The operator is obliged, within five working days after receiving the relevant application of the personal data subject, unless another period is provided for by legislative acts, to provide him or her with information in accessible form specified in part one of paragraph 1 of this Article, or notify him or her about reasons for refusing to provide it. This information is provided to the personal data subject free of charge, except in cases provided for by legislative acts.

3. The information specified in part one of paragraph 1 of this Article is not provided:
if personal data can be obtained by any person by sending a request in the manner prescribed by legislation or by accessing an information resource (system) in the Internet;
if personal data processed:
in accordance with legislation on the state statistics;
in accordance with the legislation in the field of national security, on the defense, the fight against corruption, the fight against terrorism and countering extremism, the prevention of money laundering, the financing of terrorist activities and proliferation of weapons of mass destruction, the State Border of the Republic of Belarus;
in accordance with the legislation on law enforcement intelligence operations, procedural and executive legislation on administrative and/or criminal process and penitentiary legislation;
for forensic accounting purposes;
in other cases, provided for by legislative acts.

4. A personal data subject has the right to require the operator to rectify his or her personal data, if personal data are incomplete, outdated or inaccurate. For this purpose, a personal data subject submits to the operator an application in the manner prescribed by Article 14 of this Law, attaching relevant documents and/or duly certified copies confirming the need to rectify personal data.
The operator is obliged, within fifteen days after receiving the application of the personal data subject, to rectify his or her personal data and notify a personal data subject about it or notify a personal data subject about reasons for refusing to rectify it, unless a different procedure for personal data rectification is established by legislative acts.

Article 12. Right to receive information about the transmission of personal data to third parties

1. A personal data subject has the right to receive information from the operator about transmission of his or her personal data to third parties once a calendar year free of charge unless otherwise provided for by this Law and other legislative acts.
In order to obtain the information specified in part one of this paragraph, a personal data subject submits to the operator an application in the manner prescribed by Article 14 of this Law.

2. The operator is obliged, within fifteen days after receiving the application of the personal data subject, to provide him or her with information about what and to whom personal data were transmitted during the year preceding the date of applying or notify the personal data subject about reasons for refusing to provide it.

3. The information specified in this Article may not be provided in cases provided for in paragraph 3 of Article 11 of this Law, as well as, if personal data processed in accordance with legislation on enforcement proceedings or in the administration of justice and organization of general courts activities.

Article 13. Right to demand the termination of personal data processing and/or their erasure

1. A personal data subject has the right to demand from the operator the free termination of his or her personal data processing, including their erasure, in the absence of a legal basis for the processing of personal data provided for by this Law and other legislative acts.
In order to exercise this right, a personal data subject submits an application to the operator in the manner prescribed by Article 14 of this Law.

2. The operator, in the case provided for in paragraph 1 of this Article, is obliged, within fifteen days after receiving the application of the personal data subject, to stop processing of personal data, as well as to erase them (ensure the termination of personal data processing, as well as their erasure by an authorized person) and notify the personal data subject about it.
In the absence of technical ability to erase personal data, the operator is obliged to take measures to prevent further processing of personal data, including their restriction, and notify the personal data subject about it within the same period.

3. The operator has the right to refuse a personal data subject to satisfy the demand for termination of the processing of his or her personal data and/or for their erasure, if there is a legal basis for the processing of personal data provided for by this Law and other legislative acts, including if they are necessary for the stated purposes of the processing, with notification a personal data subject within fifteen days about it.

Article 14. The procedure for applying to the operator by a personal data subject

1. A personal data subject, to exercise the rights provided for in Articles 10–13 of this Law, submits to the operator an application in writing form or the form of an electronic document. Legislative acts may provide for the mandatory personal presence of a personal data subject and presentation of an identity document when submitting the application in writing form.

2. The application of a personal data subject must contain:
surname, first name, patronymic name (if any) of a personal data subject, residential address (address of stay);
date of birth of a personal data subject;
the identification number of a personal data subject, in the absence of such number – the identity document number of a personal data subject if this information was indicated by a personal data subject when his or her consent was given to the operator or personal data processed without the consent of the personal data subject;
the essence of demands of a personal data subject;
a physical or digital signature of a personal data subject.

3. The response should be sent to a personal data subject in the form corresponding to the application submission form unless otherwise indicated in the application.

Article 15. Right to appeal against actions (inaction) and decisions of the operator related to processing of personal data

1. A personal data subject has the right to appeal against the actions (inaction) and decisions of the operator that violate his or her rights in the processing of personal data to the authorized agency for the protection of personal data subjects’ rights in the manner prescribed by legislation on appeals of citizens and legal persons.

2. The decision taken by the authorized agency for the protection of personal data subjects’ rights may be appealed by a personal data subject to the court in the manner prescribed by legislation.

Article 16. Obligations of the operator

1. The operator is obliged to:
explain to a personal data subject his or her rights related to the processing of personal data;
obtain the consent of the personal data subject, except in cases provided for by this Law and other legislative acts;
ensure the protection of personal data during their processing;
provide a personal data subject with information about his or her personal data, as well as about the transmission of his or her personal data to third parties, except cases provided for by this Law and other legislative acts;
rectify personal data that are incomplete, outdated, or inaccurate, unless a different procedure for rectification of personal data is established by legislative acts or purposes of personal data processing do not imply subsequent rectification of such data;
terminate the processing of personal data, as well as erase or restrict them (ensure the termination of processing of personal data, as well as their erasure or termination by an authorized person) in the absence of a legal basis for the processing of personal data provided for by this Law and other legislative acts;
notify the authorized agency for the protection of personal data subjects’ rights about violations of personal data protection systems immediately, but no later than three working days after the operator became aware of such violations, except as provided for by the authorized agency for the protection of personal data subjects’ rights;
rectify, terminate or erase false or illegally obtained personal data of a personal data subject at the request of the authorized agency for the protection of personal data subjects’ rights, unless a different procedure for rectification, termination or erasure of personal data is established by legislative acts;
fulfill other requirements of the authorized agency for the protection of personal data subjects’ rights to eliminate data protection legislation violations;
perform other obligations stipulated by this Law and other legislative acts.

2. The operator, which is a republican public authority, publicizes on its official website the information resources (systems) containing personal data, which are owned by it, except information resources (systems) containing:
personal data processed in cases provided for in sub-paragraphs four to seven of paragraph 3 of Article 11 of this Law;
personal data of its employees during their labor (service) activities;
classified information.

Article 17. Measures to ensure personal data protection

1. The operator (authorized person) is obliged to take legal, organizational and technical measures to ensure personal data protection against unauthorized or accidental access, modification, termination, copying, dissemination, transmission, erasure of personal data, as well as against other illegal actions on personal data.

2. The operator (authorized person) determines the list of measures necessary and sufficient to ensure the fulfillment of the obligations on personal data protection, taking into account the requirements of this Law and other acts of legislation.

3. Mandatory measures to ensure personal data protection are:
appointment of a data protection officer or establishing a dedicated structural unit by an operator (authorized person), which is a public authority, a legal person of the Republic of Belarus, another organization;
publication of documents defining personal data processing policy of an operator (authorized person), which is a legal person of the Republic of Belarus, another organization, individual entrepreneur;
familiarization of employees of an operator (authorized person) and other persons directly involved in the processing of personal data with the provisions of data protection legislation, including requirements for personal data protection, documents defining personal data processing policy of the operator (authorized person), as well as training of these employees and other persons in the manner prescribed by legislation;
establishing the procedure for access to personal data, including those processed in the information resource (system);
implementation of technical and cryptographic personal data protection in the manner established by the Operational and Analytical Center under the President of the Republic of Belarus, in accordance with classification of information resources (systems) containing personal data.

4. The operator (authorized person), which is a legal person of the Republic of Belarus, another organization, an individual entrepreneur, is obliged to provide unrestricted access, including using the Internet, to the documents defining personal data processing policy of the operator (authorized person), before the start of the processing.

5. The classification of information resources (systems) containing personal data is established by the authorized agency for the protection of personal data subjects’ rights in order to determine technical and cryptographic personal data protection demands placed on them.

CHAPTER 4
THE AUTHORIZED AGENCY FOR THE PROTECTION
OF PERSONAL DATA SUBJECTS’ RIGHTS.
LIABILITY FOR VIOLATION OF THIS LAW

Article 18. The authorized agency for the protection of personal data subjects’ rights

1. The authorized agency for the protection of personal data subjects’ rights takes measures to protect the rights of personal data subjects when processing personal data.

2. The authorized agency for the protection of personal data subjects’ rights acts independently on the legal basis of this Law and other acts of legislation. It is not allowed to assign to the authorized agency for the protection of personal data subjects’ rights functions that are incompatible with the protection of personal data subjects’ rights, except for the processing of personal data in the exercise of the powers provided for in paragraph 3 of this Article.

3. The authorized agency for the protection of personal data subjects’ rights:
exercises control over the processing of personal data by operators (authorized persons) in accordance with legislative acts;
handles complaints of personal data subjects regarding the processing of personal data;
requires operators (authorized persons) to rectify, restrict or erase false or illegally obtained personal data, eliminate other violations of this Law;
determines the list of foreign countries on whose territory an adequate level of protection of personal data subjects’ rights is ensured;
issues permit for the cross-border transfer of personal data to the third countries if an adequate level of protection of personal data subjects’ rights is not ensured;
participates in the preparation of draft acts of data protection legislation;
gives explanations on the application of data protection legislation, conducts other explanatory work on data protection legislation;
participates in international organizations on the personal data protection issues;
publishes in the media a report on its activities, annually, no later than March 15 of the year following reporting;
exercises other powers provided for by this Law and other legislative acts.

4. Public authorities, legal persons of the Republic of Belarus, other organizations and individuals are required to provide the information necessary to determine the legality of the operators’ (authorized persons’) actions to the authorized agency for the protection of personal data subjects’ rights.

5. The authorized agency for the protection of personal data subjects’ rights is determined by the President of the Republic of Belarus.

Article 19. Liability for violation of this Law

1. Persons guilty of violating this Law are liable under the legislative acts.

2. The moral damage caused to a personal data subject as a result of the violation of his or her rights established by this Law is subject to the compensation. Compensation for moral damage is carried out regardless of compensation for property damage and losses incurred by the personal data subject.

CHAPTER 5
FINAL PROVISIONS

Article 20. Measures to implement the provisions of this Law

The Council of Ministers of the Republic of Belarus shall:
within three months, together with the Operational and Analytical Center under the President of the Republic of Belarus, take measures to create an agency for the protection of personal data subjects’ rights;
within six months:
together with the National Center of Legislation and Legal Research, prepare and submit, in the prescribed manner, proposals on bringing legislative acts in compliance with this Law;
bring decisions of the Government of the Republic of Belarus in compliance with this Law;
ensure the bringing by the republican public authorities, subordinated to the Government of the Republic of Belarus, of their normative legal acts in compliance with this Law;
take other measures to implement the provisions of this Law.

Article 21. Entry into force of this Law

This Law shall enter into force in the following order:
articles 1 – 19 – in six months after the official publication of this Law;
other provisions – after the official publication of this Law.