Training on personal data protection and assistance in adapting the company’s processes in terms of personal data processing

Entered into force on November 15, 2021 the Law of the Republic of Belarus “On the Protection of Personal Data” No. 99-Z (hereinafter referred to as the Law) establishes restrictions on the admissibility of the collection and processing of personal data. Personal data processing of should be proportionate to the set objectives and ensure a fair balance of interests of all persons involved in this process.

In addition, on the 15th of November a number of provisions of Decree of the President of the Republic of Belarus “On Measures to Improve the Protection of Personal Data” No. 422 (hereinafter referred to as the Decree) entered into force, according to which:

1. at least once every five years operators [1](authorized persons) provide training on the protection of personal datafor persons responsible for internal control over personal data processing, as well as persons directly engaged in  personal data processing;
2. operators, which are state bodies, legal entities of the Republic of Belarus, and other organizations, install and maintain up-to-date:

• the list of information resources (systems) containing personal data, the owners of which they are;
• categories of personal data to be included in such resources (systems):
• publicly available personal data;
• special personal data (except for biometric and genetic personal data);
• biometric and genetic personal data;
• personal data that is not publicly available or special;
• the list of authorized persons, if personal data is processed by authorized persons;
• the period of storage of processed personal data;

3. operators (authorized persons) until December 15, 2021, and in subsequent years – until November 15, submit to the National Center for Personal Data Protection the information on the number of persons responsible for internal control over the processing of personal data, as well as persons directly involved in the processing of personal data who need to be trained at the National Center for Personal Data Protection.

In order to ensure that organizations (operators, authorized persons) comply with the requirements of the Decree, our specialists are ready to conduct training and assist in adapting the company’s processes in terms of personal data processing in accordance with the legislation of the Republic of Belarus and preparing a basic package of documents:

• Personal Data Protection Policy in accordance with the requirements of the legislation of the Republic of Belarus (if necessary, in compliance with GDPR requirements);
• Internal guidelines for personal data processing (for convenience of adaptation);
• Non-disclosure agreement;
• Personal data processing workflow chart;
• Development of an additional general agreement on personal data protection in accordance with the requirements of the legislation of the Republic of Belarus (if necessary, GDPR) for further conclusion of such an additional agreement with counterparties (including acceptable methods of transferring personal data);
• Consent to personal data processing (if it is lacking), including the preparation of additional consent in case the data of their minor children is provided;
• Order on the appointment of a person responsible for working with personal data and for the implementation of internal control over personal data processing; order on the approval of the Policy; order on the approval of the Guidlines;
• A letter to the National Center for Personal Data Protection and, respectively, communication with this center.

If you are interested, please let us know by email or through the feedback form on the contact page.

You can also read more on our website about the Law on the Protection of Personal Data and the GDPR.

[1] For reference: Operator is a state body, a legal entity of the Republic of Belarus, another organization, an individual, including an individual entrepreneur, independently or jointly with other specified persons organizing and (or) processing personal data;