Law: Law of 11 May 2010 No. 998-IIIQ on Personal Data (only available in Azerbaijani here) ('the Personal Data Law')

Regulator: Ministry of Transport, Communications and High Technologies ('the Ministry')

Summary: The Law of May 11, 2010, No. 998-IIIQ on Personal Data (the Personal Data Law) was adopted on the same date. The Personal Data Law is supplemented by several Decrees including the Requirements for the Protection of Personal Data and the Regulations on Transmission of Personal Data Collected and Processed at Corporate Information Systems to Third Parties on Fee Basis.

The Personal Data Law provides general data protection requirements including regarding data subject rights, obligations of data controllers and processors, and restrictions on data transfers. Importantly, cross-border transfer is prohibited when it creates a threat to the national security of the Republic of Azerbaijan. Notably, the Personal Data Law establishes the requirement to register the information system of personal data with the relevant executive state authority, without which it is not allowed to collect and process personal data. The Ministry of Transport, Communications and High Technologies (the Ministry) is the regulator under the Personal Data Law and is authorized to conduct inquiries and adopt measures, although it has not been particularly active in enforcing the Personal Data Law.

On the international front, Azerbaijan is a member of the Council of Europe and signatory to several major international treaties which stipulate privacy related requirements, including the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (the Convention 108).