Personal Data Protection

Personal data – any information about an individual that allows them to be identified. Companies and individual entrepreneurs (and even citizens without entrepreneur status) who work with personal data of clients and other persons must ensure established personal data protection measures.

In Belarus, the key document in this area is the Law “On Personal Data Protection,” which has been in effect since November 2021. It establishes the procedure for storing, using, and deleting data. Personal data protection rules apply to absolutely all areas of activity: e-commerce, retail, services, medicine, manufacturing, etc.

Key points when developing documents:

1. identify all business processes that involve personal data
2. clearly know the flow of personal data within the company
3. track the data transferred and the purposes of transfer
4. do not process more data than necessary
5. establish the scope of access to personal data for departments and specialists
6. know information about the software used (developer, server location, etc.)
7. timely amend documents when business processes change

How often should personal data documents be updated?

The legislation does not establish a frequency for changing documents. However, the responsible person should periodically conduct monitoring within the company and make proposals for changes to the documents. Documents should also be supplemented when opening a new business direction, switching to other software products, changing website maintenance contractors, changing the organizational structure, etc.

Is a cookie processing policy mandatory for every website?

Yes, a cookie processing policy must be placed on every organization’s website, because different cookies may be connected to websites.

The most common business violations in the field of personal data protection:

1. absence of personal data protection measures (no key documents, free external access to data)
2. transfer of information to unsafe jurisdictions in violation of the Law (use of Google, Telegram, Viber services)
3. collection of all possible information about a citizen
4. absence of processing grounds

Is additional consent for processing required when concluding a contract?

There is no such need (para. 15 of Article 6 of the Law). However, it is important to remember that such an exception applies only to the party to the contract (the citizen), but not to other persons (employees, partners, etc.).

What to do in case of a personal data breach?

1. Determine whether the protection system was breached (unauthorized copying of data by an employee, external attack, etc.)
2. Assess the consequences: whether the data fell into the hands of other persons, whether data was changed, blocked, or deleted
3. If the answers to the first two points are affirmative – a notification should be sent to the National Center for Personal Data Protection. The deadline for sending is immediately, but no later than 3 working days (Order of the National Center for Personal Data Protection No. 13 of November 15, 2021)

The most common question in practice: can the functions of the person responsible for internal control be outsourced

Unfortunately, no. The Law prescribes that the responsible person must be either a company division or a specific company employee.