Armenia

Article 1(1) of the Law on Protection of Personal Data (HO-49-N) says what the law is about. It covers the use of personal data by state or local government bodies, by state or community bodies, and by companies and individuals. It also covers state supervision of that work. There is nothing like Article 3 of the European General Data Protection Regulation. We read the whole consolidated law on 18 August 2026. It has no rule applying it to companies outside Armenia. It has no rule making you appoint a local representative. Article 1(2) leaves out state, banking, notary, lawyer and insurance secrets. It also leaves out national security and defence work, anti-money-laundering work, covert investigation and court proceedings. Those are governed by their own laws. Article 1(4) confirms that other laws may set their own rules on using data and on supervision. Where another law names a supervisory body, the privacy regulator uses its powers in the way the privacy law sets out.

Article 27 of HO-49-N sets the structure. Article 27(1): to send data abroad you need either the person's consent or a clear link to the purpose you are using the data for. Article 27(2): you need no permission from the regulator if the destination gives enough protection. That test is met if the transfer runs under an international treaty, or if the destination is on the list the regulator publishes. Article 27(3) and 27(4): for any other country, you must apply in writing before you send anything. You must describe the destination, the recipient, the data, the purpose and the contract or draft contract. The regulator has 30 days to allow or refuse. It must say what contract changes would make the guarantees good enough. Article 27(6): personal data held by state bodies may go to foreign state bodies only under ratified international treaties. INDUSTRY OVERRIDES. (1) Government. Government decision N 884-L of 14 June 2024, called 'Cloud First', covers state bodies. If they put state information systems, data or information in a cloud outside Armenia, they must keep a backup copy in Armenia. That backup must sit on the minimum server capacity needed. Only public information rated 'low' risk, and not a state secret, may go into a cloud at all. (2) Banking, notary, lawyer and insurance secrecy. These are conditional, but by a different route. Article 1(2) of the privacy law removes them from its reach, so the approved-country list gives no cover. The Law on Bank Secrecy of 7 October 1996 lists exactly who may receive bank secrets, and foreign service providers are not on that list. (3) Health. Conditional. The anonymised database inside the national electronic health system is declared the property of the Republic of Armenia. It is managed under a procedure the government sets. Sharing medical secrets without written consent is a crime. (4) Vital-sector operators. These cover energy, transport, water, communications, post, financial services, health, information technology, space, database operation, public administration and others. There is no rule on where their data sits, but the new cybersecurity regulator supervises them. Telecoms: operators must keep customer data confidential. They must also give law-enforcement and national-security staff access to communications equipment, including interception devices. That keeps interception equipment inside the country. We found no express rule requiring telecom, insurance, securities, education, gaming or mapping data to stay in Armenia. Checked 18 August 2026, medium confidence.

The approved list is Decision N ATPP-001/24, in force 10 July 2024. It covers: Albania, the United States (organisations only), Andorra, Austria, Argentina, Belgium, Bosnia and Herzegovina, Bulgaria, Germany, Denmark, Estonia, Iceland, Ireland, Italy, Spain, Israel, Latvia, Liechtenstein, Lithuania, Luxembourg, Poland, Croatia, Canada, Republic of Korea, Cyprus, North Macedonia, Greece, Hungary, Japan, Malta, the United Kingdom, Moldova, Monaco, Montenegro, the Netherlands, New Zealand, Norway, Sweden, Switzerland, Czechia, Portugal, Romania, the Russian Federation, San Marino, Serbia, Singapore, Slovakia, Slovenia, Georgia, Ukraine, Uruguay, Finland and France. Countries missing from the list need permission case by case. They include India, China, Australia, Brazil, Mexico, Turkey, the United Arab Emirates, Kazakhstan and Azerbaijan. The United States entry carries the word 'organisations'. That reads as approval for certified companies rather than for the whole country. The decision does not define the word any further. Two points about how this works. First, this is one official's decision, not a law or a government decree. The head of the agency can add or remove a country, including Russia, with one signature and no consultation. Second, Article 27(5) makes the regulator review the list at least once a year and publish changes. No revision has appeared since July 2024, more than two years ago. So the yearly review duty looks unmet.

Article 24 of HO-49-N gives the agency real powers. It can inspect on its own initiative, impose administrative penalties, and order you to block, suspend or stop using data. It can order you to correct or destroy data. It keeps a register, applies to court, and publishes a yearly report. Article 25 sets an unusual appointment route. The Prime Minister appoints the head for five years, on the nomination of the Minister of Justice. The candidate comes from a list proposed jointly by at least five human-rights non-governmental organisations. Nobody may serve two terms in a row. What we can see about how it operates. Prime Minister's decision N 120-A of 13 February 2026 released Grigor Nersisyan as Head of the Agency from 24 February 2026. He asked to go in writing. We searched the official legal database on 18 August 2026 and found no later appointment decision. The 2015, 2018 and 2023 appointments were all published there. Fine decisions under Article 189.17 of the Code of Administrative Offences are not published in the legal database. So we cannot rule out a small amount of enforcement work. We found no published enforcement decision and no yearly report. We could not reach the agency's own website, because the Ministry of Justice site blocks automated access. So this rating rests on the official acts database alone. The Information Systems Regulatory Commission is different. It was created by law HO-444-N of 4 December 2025 and was actually set up. The National Assembly appointed Nerses Yeritsyan as chairman on 26 March 2026. It appointed Nairi Adamyan and Srbuhi Hakobyan on the same day, and David Khachatryan on 16 April 2026. The law treats the Commission as formed once four members are appointed, so it now exists. The 2026 state budget was changed to fund it.

MINIMUM KEEP-TIMES. Article 56 of the Tax Code makes taxpayers keep documents that back up the tax base, income, expenses and taxes paid or withheld. The period is not less than five years from the reporting period they relate to. Financial firms reporting under the international common reporting standard have the same five-year minimum. It covers account documents and the contents of computer systems and electronic media. MAXIMUM KEEP-TIMES. Article 5(5) of HO-49-N says personal data must be stored so that the person cannot be identified for longer than the stated purpose needs. Article 19(1) makes you destroy or block data you do not need for the lawful purpose. Article 21(5) makes you stop using data immediately once the purpose is met, unless another law says otherwise. Article 21(6) sets the ten-working-day deadline to destroy data after a written or digitally signed consent withdrawal. It then gives you three working days to confirm the destruction to the person. Article 21(3) sets the three-working-day deadline to put unlawful use right. If you do not, the data must be destroyed at once. CLASHES. The law does not settle minimum against maximum with a general rule. It settles it by exception. Article 21(5) and Article 21(6) both give way where another law says otherwise. So a legal duty to keep data, such as the five-year tax rule, beats the duty to delete. Article 8 also makes using data lawful where a legal duty requires it.

Article 21(4) of HO-49-N is unusual and easy to miss. If personal data leaks from electronic systems, you must publish a statement immediately. At the same time you must report the leak to the Police of the Republic of Armenia and to the privacy regulator. Look at what it does not say. There is no severity threshold, no risk test, and no option to tell the regulator quietly first. Telling the public is the main duty. Article 11 of the Law on Cybersecurity HO-442-N, in force 4 January 2026, runs the second set of deadlines. It applies to service providers in the fourteen vital industries. You must tell the Autonomous Body immediately, and no later than 24 hours after you learn of the incident. That applies to any incident with a real effect on continuous, uninterrupted or secure operation. It also applies where you cannot yet judge the effect but can reasonably assume there is one. You must send updated information within 72 hours. You must tell the people who may be affected immediately, or within two days if that is not possible. If you do not, the regulator may tell those people or the public itself. You must file a final report within one month of the 72-hour update. It must cover causes, fixes, severity, scale, time spent, money spent and steps to prevent a repeat.

1. PUBLIC ANNOUNCEMENT OF LEAKS. Article 21(4) makes you publish the announcement. You report to the police and the regulator at the same time. Most breach plans assume you tell the regulator first and the public later. Armenia reverses that. 2. ENCRYPTION IS COMPULSORY. Article 19(2) makes everyone use encryption to protect information systems holding personal data. Article 189.17(5) of the Code of Administrative Offences makes not using encryption an offence on its own. The fine is 100 times the statutory calculation base, about 100,000 drams (roughly 260 US dollars). 3. TELL THE REGULATOR FIRST FOR SENSITIVE AND BIOMETRIC DATA. Article 23(3) makes you notify the regulator before you use biometric or special-category data. Article 23(5) gives the regulator 30 days to enter the details in its register. Article 23(8) makes you send updates within ten working days of any change. This is a registration duty in all but name. Today it is owed to an authority with no head. 4. DEAD PEOPLE. Article 9(10) makes you get the consent of all legal heirs to use the personal data of someone who has died. The same applies to someone declared dead. Where there are no heirs, consent comes from the head of the community where the succession opened. There is no time limit on this. 5. CHILDREN AT 16. Article 9(9) makes you get the legal representative's consent for anyone under 16. The same applies to people who lack legal capacity or whose capacity is limited. Armenia has no separate, lower age for digital consent. 6. INDIVIDUALS CAN GO TO PRISON. Article 204 of the Criminal Code covers using, selling or disclosing someone's personal or family secret without consent. The penalty is up to one year in prison. It rises to three years where the secret is spread through the media or online. Article 205 covers disclosing medical secrets without written consent. The penalty is up to two years, rising to three years where it is published, and higher again where a health worker did it. 7. THE PRIVACY FINES ARE TINY, THE SECRECY FINES ARE NOT. The largest administrative fine for a data protection breach is 500 times the calculation base. That is about 500,000 drams (roughly 1,300 US dollars). Article 189.17(8) also lets you escape liability altogether if you fix the breach by the deadline the regulator sets. Unlawful disclosure of bank secrecy is different. A court can fine you 2,000 to 10,000 times the base, roughly 5,200 to 26,000 US dollars. You may also face criminal charges and have to cover the customer's full loss.

ALREADY HAPPENED. Law HO-191-N was adopted on 7 May 2026 and came into force on 15 August 2026. That was three days before this record was written. It deletes the rule that the head of the privacy regulator must leave at 65. So there is no longer an age limit for the job. DATED AND COMING. Article 25 of the Law on Cybersecurity covers the detailed rules and the national cybersecurity standard. They are due within twelve months of 4 January 2026, so by 4 January 2027. Service providers must adopt internal cybersecurity rules within eighteen months, so by 4 July 2027. They must also complete risk assessments and incident-prevention programmes by that date. Operators of critical information infrastructure and cybersecurity service providers must produce a certificate within twenty-four months. It must show they meet an international or national cybersecurity standard, so it is due by 4 January 2028. Cybersecurity service providers then face an audit one year after certification. Article 61 of law HO-444-N covers the Information Systems Regulatory Commission's own rules. They are due within one year of 26 December 2025, so by 26 December 2026. A package on state fees is due on the same timetable. POWERS ALREADY HELD. These matter more than the pending laws. (1) The approved-country list is one official's decision. Adding or removing a country, including the Russian Federation or the United States, takes one signature. It takes effect the day after publication, with no consultation. The post is vacant, so the power sits with whoever the Prime Minister appoints next. (2) The Government has not yet approved the criteria for identifying critical information infrastructure. It has not approved the list of identified infrastructures either, nor the state bodies that supervise them. That is Article 16(1) and 16(2) of the Law on Cybersecurity. When it does, named companies pick up the full set of cybersecurity duties overnight. Article 16(6) also lets the regulator name a single system as critical infrastructure by notice, temporarily. It then has four months to make that permanent. (3) Article 8 of the Law on Cybersecurity covers control of information systems and critical infrastructure in emergencies, martial law or a state of emergency. It has been passed but is not yet in force. It starts only when the government act that implements it starts. (4) The government may extend the 'Cloud First' backup-in-Armenia rule further. The policy already invites autonomous and independent state bodies to follow it voluntarily. That is usually how such rules become compulsory later.