Azerbaijan

The Law 'On Personal Data' (No. 998-IIIQ, 11 May 2010) defines its subject matter in the preamble and article 1 by reference to relations inside the country and to 'the personal data section of the national information space'. There is no article equivalent to GDPR article 3(2). Article 15.1 requires every personal data information system, including those existing before the law commenced, to pass state registration with the authorised executive body. Law No. 431-VIIQD of 30 June 2026 adds article 13-5.1 to the Information Law, requiring a provider of an age-restricted social network platform serving users in Azerbaijan to be tax-registered if an individual, or state-registered through a branch or representative office if a foreign legal entity. That branch may not carry on business in the provider's name (article 13-5.3); it exists to be a point of contact.

Article 14.2 of the Law 'On Personal Data' prohibits cross-border transfer where it creates a threat to the national security of Azerbaijan, or where the legislation of the receiving country does not ensure legal protection of the data at the level established by Azerbaijani legislation. Article 14.3 disapplies that test where the subject has consented or where the transfer is necessary to protect the subject's life and health. Article 14.4 puts security of the data in transit on the owner or operator. There is no published adequacy list and no published blacklist, so the assessment is entirely self-executed. Sector checks performed on 18 August 2026: the Law on Payment Services and Payment Systems and all eleven payment rules in force published by the Central Bank were read in full and contain no data-location requirement; the Central Bank's requirements for payment institutions cover physical security of the server room and penetration testing, not geography. Government is the one place where location is effectively fixed, by architecture rather than by an express ban: state information systems are being consolidated into the domestic Government Cloud. Health, education, telecom and geospatial sector location rules were searched for and none were found; see the unconfirmed list.

Article 15.4.13 of the Law 'On Personal Data' requires the registration application to state 'the categories of personal data transferred across borders to other states and to international organisations'. Article 15.5 requires any change to the registered particulars to be notified in writing within 3 working days, so starting a new export route triggers a filing. Article 13.1 separately requires the subject's written consent, including consent given through the Electronic Government Information System, before personal data is passed to any third party, subject to narrow exceptions in article 13.2 for open-category data, for state bodies performing statutory functions, and for protecting life and health. The model is therefore best described as a blacklist that has never been populated, wrapped in a mandatory declaration.

The decree of 3 June 2026 creates the National Cybersecurity Agency (Milli Kibertehlukesizlik Agentliyi) as a public legal entity, the legal successor of the Electronic Security Service, 'operating in the field of protection of personal data'. Its charter lists, among others: maintaining the state registration and state register of personal data information resources and systems (clause 3.1.25); examining and investigating complaints from data subjects whose rights were breached by unlawful collection, processing or failure to secure personal data (3.1.24); requiring removal of breaches of the Law 'On Personal Data' (3.1.28); joint inspection of registered systems against their declared purposes (3.1.29); auditing owners and operators on request (3.1.30); and taking measures under the Code of Administrative Offences where it finds an offence (3.1.26). Certain systems are carved out: those of top-category state bodies, of bodies protecting guarded persons and strategic objects, of intelligence and counter-intelligence bodies, and personal data classified as state secret. Separately, the Computer Incident Response Centre of the Special Communication and Information Security State Service, at cert.gov.az, is active and publishing, and the Central Bank runs FinCERT for the financial sector with its own high-severity incident portal. One caveat on operational status: the register site still names the abolished Electronic Security Service and gives a registry@cert.az contact address, so government pages have not all caught up with the June 2026 reorganisation.

Ceilings: article 9.4 of the Law 'On Personal Data' requires destruction without delay once the collection and processing purposes are achieved and the need to store the data has passed; article 9.8 requires special-category data to be blocked and destroyed without delay once the ground for holding it falls away, unless the subject consents to storage or archiving; article 15.6 requires immediate blocking and destruction where state registration of the system is cancelled. Article 5.10 defers archiving rules to separate archive legislation. Floors: article 20-12.6 inserted by Law No. 454-VIIQD of 14 July 2026 requires the formalisation and results of a digital investigation, together with the supporting documents, to be kept by the research centre for not less than 3 years. Article 9.12 of the personal data law requires control and audit logs of processing operations to be maintained, but sets no period. General tax and accounting retention floors were not verified in this pass and are listed as unconfirmed.

The Law 'On Personal Data' contains no breach reporting article; article 5.8 requires technical and organisational measures against accidental and unauthorised destruction, loss, unlawful interference and alteration, but with no notification consequence. The Cabinet-approved Requirements for the Protection of Personal Data require timely detection of unlawful interference and an internal written finding after a confidentiality breach, again with no external report. The incident clocks come from Law No. 454-VIIQD of 14 July 2026, which inserts article 20-9.1.8 (pass cyber threat, attack and incident information to the National CERT immediately, keep statistics and file analytical reports quarterly), article 20-9.1.2 (24 hours for proactive cybersecurity research requests, 5 working days for digital investigation requests) and article 20-10.9 (the same 24-hour and 5-working-day clocks for internet providers, hosting providers and owners of internet information resources). The National Cybersecurity Agency has been designated as the National CERT.

(1) Article 15.2 of the Law 'On Personal Data' bars collection and processing in a system that should be registered but is not; article 15.4 gives the authority one month to register. Cabinet Decision No. 237 of 17 December 2010 exempts state secret systems, employee and site-access systems, and a set of categories only where they hold fewer than 1,000 subjects, so an ordinary customer database is generally in scope. (2) The Requirements for the Protection of Personal Data set out 23 mandatory measures at clause 2.1, including 2.1.17 (archive system of the data centre located in a separate building), 2.1.21 (encryption key length not less than 256 bits), 2.1.18 (licensed software only), 2.1.20 (users must reach the system through their own protection servers) and 2.1.23 (state expertise of the system's design documents). Controlling bodies monitor compliance at least once a year. (3) Article 10.5 of the personal data law requires the operator to create the conditions for intelligence, counter-intelligence and operational search measures, resolve the organisational and technical issues, and observe the confidentiality of the methods used. (4) Article 375 of the Code of Administrative Offences sets 300 to 500 manat for processing in an unregistered system and for failing to secure or destroy data; article 379 sets 3,000 to 4,000 manat on legal persons for using an uncertified information system or database. (5) Article 9.14 states that forming personal data information resources, creating information systems and providing services to them may be carried out only under a special permission (licence); we found no operating licence scheme matching this, so it reads as unenforced text.

Law No. 431-VIIQD of 30 June 2026 amends the Information Law, the Law on Protection of Children from Harmful Information and the Code of Administrative Offences. Article 4.1 provides that the law enters into force twelve months after the day it is published; the implementing presidential decree is dated 5 August 2026, so commencement falls around August 2027. Before commencement, providers must have the technical means for age checks in place and must tell the designated body (article 4.2); after commencement they must block and delete accounts of under-16s who cannot prove their age (article 4.3). The age-verification data may not be stored in the provider's own system, may not be passed to third parties, may not be used for commercial or targeted advertising, and must be deleted the moment the check finishes (articles 13-4.8 and 13-4.9). Enforcement under article 13-5.6 runs: written warning, then 100,000 manat (about 59,000 US dollars), then 300,000 manat (about 176,000 US dollars), then a ban on state bodies and Azerbaijani taxpayers advertising on the platform, then court-ordered traffic throttling of 20 per cent, then 50 per cent, then 90 per cent. New article 388-4 of the Code of Administrative Offences adds fines on legal persons of up to 40,000 manat (about 23,500 US dollars). Dormant switches to watch, all of which can move without consultation: the list of platforms caught by the age rule is set by a body the executive designates; the government may at any time treat a named country as failing the article 14.2 protection test, since nothing has to be published; the National Cybersecurity Agency's charter lets it restrict a seller's activity in the country for e-commerce disclosure failures; and the list of internet resources carrying prohibited information, which providers must block immediately, is administrative.