Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Biometric privacy
What it requires →
Art. 9.5 enumerates biometric data in detail: fingerprints and palm prints, facial image, iris and retina of the eye, sound fragment and its acoustic parameters, DNA, body-measurement results, description of special features and physical defects of the body, handwriting, signature, and other biometric data, and states that the Act's general processing conditions (Art. 9.1-9.6) are fully applicable to it.
This is a deliberate, textually confirmed choice: biometric data is not elevated to the heightened special-categories regime of Art. 9.7 that governs race, health, and similar categories elsewhere in this same Act, so there is no biometric-specific explicit-consent requirement, no dedicated retention or destruction duty, and no dedicated storage-technology requirement anywhere in this Act.
A service may create and store a voiceprint (the Act's own term is sound fragment and its acoustic parameters) or a faceprint on whatever general basis Art. 9.6 supplies for any other personal data, most plausibly consent for an open category or a legislative basis, and must destroy it only under the Act's general Art. 9.4 duty to destroy data without delay once its processing purpose has been achieved.
A reader should not infer from this instrument's law_family or flags_on alone that Azerbaijan treats biometric data the way this batch's other jurisdictions do; the Act plainly reaches voice and face identifiers, just not as a sensitive category.
Comprehensive regime
What it requires →
Azerbaijan's Law on Personal Data, Law No. 998-IIIQ, signed 11 May 2010 and amended at least five times through 2023, is a compact 19-article statute, the shortest in this batch alongside Armenia's. Lawful bases sit at Art. 9.6: consent for data in an open category, a legislative basis defining purpose and method, fully anonymized scientific or statistical research, or vital-interest necessity, a shorter list than several regional peers'.
Art. 9.5's biometric-data enumeration is subject to these same ordinary lawful bases, not a heightened regime; see the dedicated biometric_privacy instrument. This document is sourced to an NATLEX-hosted English translation with visible machine-translation artifacts; an official Azerbaijani-language source should ideally be cross-checked, though the substance read here is internally consistent.
Cross border transfer
What it requires →
Transfer is the default rule under Art. 14.1, prohibited only where it threatens national security (Art. 14.2.1) or the destination country's law does not ensure legal protection at the level determined by the legislation of the Republic of Azerbaijan (Art. 14.2.2).
Art. 14.3 then creates a broad override: with the data subject's consent, or where necessary to protect the subject's life or health, transfer may proceed regardless of the destination's actual level of legal protection, meaning consent fully overrides the adequacy-style standard rather than merely supplementing it.
No standard-contract, binding-corporate-rule, or authority-permit mechanism exists for a non-adequate destination, unlike several regional peers' authority-approval or contract-approval routes; this is a noticeably thinner, more binary regime, coded strict at the jurisdiction level rather than moderate for that reason. No data localization is compelled.
Data subject rights
What it requires →
Art. 7 gives a data subject the right to learn whether their data is held, to request the legal justification for its collection, processing, or third-party transfer and the consequences of that transfer, to access the data's content, to know the processing purpose, retention period, methods, and who has access, to demand correction and, subject to statutory exceptions, destruction or archiving instead, to demand a ban on collection or processing, to learn the data's source and demand proof of lawful collection, to demand protection, and to receive information about a system's conformity certificate or state examination.
Art. 7.2 adds a written, substantiated objection right that requires the controller to immediately stop processing on receipt unless processing is legally mandatory, and Art. 7.3 adds a right to object to a decision produced through information-technology processing that harms the subject's interests, triggering either a consent-seeking obligation or an immediate processing halt. Art. 7.4 separately gives a damages right, recorded in the enforcement instrument.
Enforcement supervision
What it requires →
Art. 17 gives a relevant executive authority, not named within this Act itself, power to check compliance of registered information systems, demand information, verify registration filings, demand remedies for violations, and take measures to prosecute violators; this document does not independently confirm which body currently holds that role.
Art. 19 (Liability) is a single sentence: persons guilty of violating this Law shall be held responsible in accordance with the legislation of the Republic of Azerbaijan, a bare reference-out to other, unread law with no fine amounts, penalty tiers, or named enforcement mechanism inside this Act itself, markedly thinner than every other jurisdiction in this batch.
Art. 7.4 gives the data subject a right to complain to the executive authority or the court, and to demand payment of moral and material damage in a court of law, an ordinary proof-of-damage civil remedy rather than a no-proof-of-damage statutory-damages mechanism. Fine amounts a secondary source claims exist in the Administrative Violations Code (300 to 500 AZN, imprisonment up to 7 years) are unconfirmed against primary text and are not stated here as sourced to this Act.
Sensitive categories
What it requires →
Art. 2.1.6 defines special categories of personal data as data related to a natural person's race or nationality, family life, religious beliefs and convictions, or health or convictions. Biometric data is not included in this list.
Art. 9.7 prohibits processing a special category absent a specific statutory ground; because biometric data sits outside Art. 2.1.6 entirely, it is not subject to this heightened Art. 9.7 regime at all, and is instead governed only by the Act's ordinary general processing conditions (Art. 9.1-9.6), recorded in a separate biometric_privacy instrument.
This instrument's flags deliberately carry no biometric activity flag, since it describes exactly the categories from which Azerbaijan's law excludes biometric data.
