Law of the Republic of Belarus On Personal Data Protection, cross border transfer of personal data

Law No. 99-Z, art. 9 (cross border transfer of personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 November 2021.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Confirm the destination country is on the authorized agency's adequate-country list before transferring personal data of a person in Belarus outside the country, or rely on one of the seven Article 9 exceptions, such as the subject's informed consent to the risks or performance of a contract with the subject, or obtain the agency's own permit.
This law has no Standard Contractual Clauses or Binding Corporate Rules self-assessment route for a cross-border transfer; an operator outside the adequate-country list and outside the Article 9 exceptions needs the authorized agency's case-by-case permit.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 9 prohibits cross-border transfer of personal data where an adequate level of protection of personal data subjects' rights is not provided in the destination country, unless one of seven listed exceptions applies, including the personal data subject's informed consent to the risks, performance of a contract with the subject, a transfer the subject could obtain by request under legislation, protecting vital interests where consent cannot be obtained, execution of a Belarusian treaty, financial monitoring against money laundering or terrorist financing, or a permit from the authorized agency.

Article 9 also gives the authorized agency for the protection of personal data subjects' rights the power to determine the list of foreign countries whose territory ensures an appropriate level of protection, so an operator transferring to a country outside that list needs one of the other Article 9 exceptions or the agency's own permit.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

National Center for Personal Data Protection's own English pages (cpd.by), read in full (71,842 characters)
corroborated by e-sud.by practitioner guide

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app