Armenia

Article 1(1) of the Law on Protection of Personal Data (HO-49-N) defines the subject matter as the processing of personal data by state administration or local self-government bodies, state or community institutions or organisations, and legal or natural persons, and state supervision over that processing. There is no equivalent of Article 3 of the EU General Data Protection Regulation. A full-text scan of the consolidated law on 18 August 2026 found no provision on extraterritorial application and no in-country representative duty. Article 1(2) carves out state, banking, notarial, advocate and insurance secrets, national security and defence processing, anti-money-laundering work, covert investigation and court proceedings — those are governed by their own statutes. Article 1(4) confirms other laws may set their own processing and supervision rules, and where another law names a supervisory body, the privacy regulator exercises its powers in the manner set by the privacy law.

Article 27 of HO-49-N sets the structure. Article 27(1): a transfer abroad needs either the person's consent or a demonstrable link to the processing purpose. Article 27(2): no regulator permission is needed where the destination ensures an adequate level of protection, which is deemed satisfied if the transfer is made under an international treaty or the destination appears on the list published by the regulator. Article 27(3)-(4): to any other country, the sender must apply in writing before transferring, describing the destination, the recipient, the data, the purpose and the contract or draft contract; the regulator has 30 days to allow or refuse and must specify what contractual changes would make the guarantees sufficient. Article 27(6): personal data held by state bodies may go to foreign state bodies only under ratified international treaties. SECTOR OVERRIDES. (1) Government — a copy must stay in the country. Government decision N 884-L of 14 June 2024 ('Cloud First') requires state administration bodies that place state information systems, data or information in a cloud located outside Armenia to keep a backup copy in Armenia on minimum necessary server infrastructure, and permits only 'low' risk-rated, non-state-secret public information to be put in a cloud at all. (2) Banking, notarial, advocate and insurance secrecy — data can leave with the right paperwork but by a different route: Article 1(2) of the privacy law removes these from its scope, so the approved-country list gives no cover; the Law on Bank Secrecy of 7 October 1996 lists exhaustively who may receive bank secrets and foreign service providers are not among them. (3) Health — data can leave with the right paperwork; the anonymised database inside the national electronic health system is declared the property of the Republic of Armenia and managed under a government-set procedure, and disclosing medical secrets without written consent is a criminal offence. (4) Vital-sector operators (energy, transport, water, communications, post, financial services, health, information technology, space, database operation, public administration and others) are not restricted on where data sits, but are supervised by the new cybersecurity regulator. Telecoms: operators must keep customer data confidential and must give law-enforcement and national-security staff access to communications equipment including interception devices, which in practice keeps interception infrastructure in-country. No express telecom, insurance, securities, education, gaming or mapping localisation rule was found — checked 18 August 2026, medium confidence.

The approved list (Decision N ATPP-001/24, in force 10 July 2024) covers: Albania, the United States (organisations only), Andorra, Austria, Argentina, Belgium, Bosnia and Herzegovina, Bulgaria, Germany, Denmark, Estonia, Iceland, Ireland, Italy, Spain, Israel, Latvia, Liechtenstein, Lithuania, Luxembourg, Poland, Croatia, Canada, Republic of Korea, Cyprus, North Macedonia, Greece, Hungary, Japan, Malta, the United Kingdom, Moldova, Monaco, Montenegro, the Netherlands, New Zealand, Norway, Sweden, Switzerland, Czechia, Portugal, Romania, the Russian Federation, San Marino, Serbia, Singapore, Slovakia, Slovenia, Georgia, Ukraine, Uruguay, Finland and France. Countries absent from the list and therefore requiring case-by-case permission include India, China, Australia, Brazil, Mexico, Turkey, the United Arab Emirates, Kazakhstan and Azerbaijan. The United States entry is qualified with the word 'organisations', which reads as a certified-organisation approach rather than blanket country approval; that qualification is not further defined in the decision. Two structural points. First, this is a single official's decision, not a statute or a government decree, so the head of the agency can add or remove a country — including Russia — with one signature and no consultation. Second, Article 27(5) obliges the regulator to review the list at least once a year and publish changes; no revision has appeared since July 2024, more than two years ago, so the annual review duty appears to be unmet.

Article 24 of HO-49-N gives the agency real powers: inspections on its own initiative, administrative penalties, orders to block, suspend or stop processing, orders to correct or destroy data, a register of processors, court applications, and an annual public report. Article 25 sets an unusual appointment route — the Prime Minister appoints the head for five years on the nomination of the Minister of Justice, chosen from a list of candidates jointly proposed by at least five human-rights non-governmental organisations, and nobody may serve two consecutive terms. The evidence on operation: Prime Minister's decision N 120-A of 13 February 2026 released Grigor Nersisyan from the post of Head of the Agency with effect from 24 February 2026, on his own written application. A search of the official legal database on 18 August 2026 found no subsequent appointment decision, although earlier appointments in 2015, 2018 and 2023 were all published there. Administrative fine decisions under Article 189.17 of the Code of Administrative Offences are not published in the legal database, so a low level of enforcement activity cannot be excluded, but no published enforcement decision or annual report was found. The Agency's own website could not be reached — the Ministry of Justice site blocks automated access — so this rating rests on the official acts database alone. By contrast, the Information Systems Regulatory Commission created by law HO-444-N of 4 December 2025 was actually stood up: the National Assembly appointed Nerses Yeritsyan as chairman and Nairi Adamyan and Srbuhi Hakobyan as members on 26 March 2026, and David Khachatryan on 16 April 2026. The law treats the Commission as formed once four members are appointed, so it has been constituted, and the 2026 state budget was amended to fund it.

FLOOR. Article 56 of the Tax Code requires taxpayers to keep documents substantiating the tax base, income, expenses and taxes paid or withheld for not less than five years from the reporting period they relate to. Financial institutions reporting under the international common reporting standard must keep account documents and the contents of computer systems and electronic media for not less than five years. CEILING. Article 5(5) of HO-49-N requires personal data to be stored so that identification of the person is not possible for longer than needed for the pre-determined purpose. Article 19(1) requires the processor to destroy or block data not needed to achieve the lawful purpose. Article 21(5) requires processing to stop immediately once the purpose is achieved, unless another law says otherwise. Article 21(6) sets the ten-working-day destruction clock after a written or digitally signed consent withdrawal, and a three-working-day duty to confirm destruction to the person. Article 21(3) sets the three-working-day clock to cure unlawful processing, failing which the data must be destroyed immediately. CONFLICT. The law does not resolve floor-versus-ceiling with a general rule; it resolves it by exception. Article 21(5) and Article 21(6) both yield to 'unless otherwise provided by law', so a statutory retention duty such as the five-year tax rule overrides the deletion duty. Article 8 also makes processing lawful where it follows from a legal obligation.

Article 21(4) of HO-49-N is unusual and easy to miss: on a leak of personal data from electronic systems the processor must immediately publish a statement, simultaneously reporting the leak to the Police of the Republic of Armenia and to the privacy regulator. Notice what it does not say: there is no severity threshold, no risk test, and no option to notify the regulator quietly first. Public disclosure is the primary obligation. Article 11 of the Law on Cybersecurity HO-442-N (in force 4 January 2026) runs the second set of clocks for service providers in the fourteen vital sectors. Notification to the Autonomous Body immediately and no later than 24 hours after becoming aware, for any incident with a material effect on continuous, uninterrupted or secure operation — or where a material effect cannot yet be assessed but can reasonably be assumed. Updated information within 72 hours. Notification of potentially affected persons immediately, or within two days if that is not possible; if the provider fails, the regulator may notify those people or the public itself. Final report within one month of the 72-hour update, covering causes, remedies, severity, scale, time spent, money spent and preventive steps.

1. PUBLIC ANNOUNCEMENT OF LEAKS. Article 21(4) requires the announcement to be published, with simultaneous reports to the police and the regulator. Most breach playbooks assume regulator-first and public-later; Armenia inverts that. 2. COMPULSORY ENCRYPTION. Article 19(2) obliges every processor to use encryption to protect information systems containing personal data. Article 189.17(5) of the Code of Administrative Offences makes not using encryption a standalone offence, fined at 100 times the statutory calculation base, about 100,000 drams (roughly 260 US dollars). 3. PRIOR NOTIFICATION FOR SENSITIVE AND BIOMETRIC DATA. Article 23(3) makes notification to the regulator compulsory before processing biometric or special-category data; Article 23(5) gives the regulator 30 days to enter the details in the register of processors; Article 23(8) requires updates within ten working days of any change. This is a registration duty in all but name, and it is currently owed to an authority with no head. 4. DEAD PEOPLE. Article 9(10) requires the consent of all legal heirs to process the personal data of someone who has died or been declared dead; where there are no heirs, consent comes from the head of the community where the succession opened. There is no time limit on this. 5. CHILDREN AT 16. Article 9(9) requires the legal representative's consent for anyone under 16, and for people lacking or with limited legal capacity. Armenia has no separate lower age of digital consent. 6. CRIMINAL LIABILITY ON INDIVIDUALS. Article 204 of the Criminal Code punishes using, selling or disclosing someone's personal or family secret without consent with up to one year in prison, rising to three years where it is spread through the media or online. Article 205 punishes a data processor who discloses medical secrets without written consent with up to two years, rising to three years where it is published, and higher again where the offender is a health worker. 7. THE FINES ARE TINY BUT THE SECRECY FINES ARE NOT. The maximum administrative fine for a data protection breach is 500 times the calculation base, about 500,000 drams (roughly 1,300 US dollars), and Article 189.17(8) lets an offender escape liability entirely by curing the breach within the deadline the regulator sets. Unlawful disclosure of bank secrecy, by contrast, carries a court-imposed fine of 2,000 to 10,000 times the base — roughly 5,200 to 26,000 US dollars — plus possible criminal liability and full compensation of the customer's loss.

ALREADY LANDED. Law HO-191-N, adopted 7 May 2026, came into force on 15 August 2026 — three days before this record was written. It deletes the rule that the head of the privacy regulator must leave at 65, removing an age ceiling from the appointment regime. DATED AND COMING. Under Article 25 of the Law on Cybersecurity, the sub-statutory acts and the national cybersecurity standard are due within twelve months of 4 January 2026, so by 4 January 2027. Service providers must adopt internal cybersecurity regulations and complete risk assessments and incident-prevention programmes within eighteen months, so by 4 July 2027. Operators of critical information infrastructure and cybersecurity service providers must produce a document certifying conformity with an international or national cybersecurity standard within twenty-four months, so by 4 January 2028; cybersecurity service providers then face an audit one year after certification. Under Article 61 of law HO-444-N the Information Systems Regulatory Commission's own implementing acts are due within one year of 26 December 2025, so by 26 December 2026, and a package on state fees is due on the same timetable. DORMANT SWITCHES — these matter more than the pending legislation. (1) The approved-country list is a decision of a single official. Adding or removing a country, including the Russian Federation or the United States, needs one signature, takes effect the day after publication, and involves no consultation. The post is currently vacant, which means the switch is held by whoever the Prime Minister next appoints. (2) The Government has not yet approved the criteria for identifying critical information infrastructure, nor the list of identified infrastructures and the state bodies responsible for supervising them, under Article 16(1)-(2) of the Law on Cybersecurity. When it does, named companies will acquire the full cybersecurity duty set overnight. Separately, Article 16(6) lets the regulator temporarily designate an individual system as critical infrastructure by notice, with a four-month window to make it permanent. (3) Article 8 of the Law on Cybersecurity, on control of information systems and critical infrastructure during emergencies, martial law or a state of emergency, has been passed but is not yet in force — it commences only when the implementing government act commences. It is a switch waiting for a lever. (4) The government may extend the 'Cloud First' backup-in-Armenia rule further; the policy expressly invites autonomous and independent state bodies to follow it voluntarily, which is how such rules usually become mandatory later.