Azerbaijan

The Law 'On Personal Data' (No. 998-IIIQ, 11 May 2010) says what it covers in its preamble and article 1. It covers relations inside the country and 'the personal data section of the national information space'. It has no equivalent of article 3(2) of Europe's General Data Protection Regulation, which reaches companies with no office in Europe. Article 15.1 requires every personal data information system to pass state registration with the authorised executive body. That includes systems that already existed when the law started. Law No. 431-VIIQD of 30 June 2026 adds article 13-5.1 to the Information Law. A provider of an age-restricted social network platform serving users in Azerbaijan must be tax-registered if it is an individual. A foreign company must instead register a branch or representative office with the state. That branch may not carry on business in the provider's name (article 13-5.3). It exists only as a point of contact.

Article 14.2 of the Law 'On Personal Data' bans sending personal data abroad in two cases. One: where it creates a threat to the national security of Azerbaijan. Two: where the receiving country's law does not protect the data to the level Azerbaijani law sets. Article 14.3 switches that test off where the person has consented. It also switches it off where the transfer is needed to protect the person's life and health. Article 14.4 makes the owner or operator responsible for keeping the data secure in transit. Azerbaijan publishes no list of safe countries and no list of banned countries. So the judgement is entirely yours. Industry checks done on 18 August 2026: we read the Law on Payment Services and Payment Systems and all eleven payment rules in force published by the Central Bank. None of them say where data must be held. The Central Bank's requirements for payment institutions cover physical security of the server room and penetration testing, not location. Government is the one place where location is fixed. That comes from how the systems are built, not from an express ban. State information systems are being moved into the domestic Government Cloud. We searched for location rules in health, education, telecoms and mapping and found none. See the unconfirmed list.

Article 15.4.13 of the Law 'On Personal Data' governs the registration application. It must state 'the categories of personal data transferred across borders to other states and to international organisations'. Article 15.5 requires you to report any change to the registered details in writing within 3 working days. So starting a new transfer route means a new filing. Article 13.1 separately requires the person's written consent before their data goes to any third party. That consent can be given through the Electronic Government Information System. Article 13.2 sets narrow exceptions for open-category data, for state bodies doing their statutory jobs, and for protecting life and health. So the model works like this. You may send data anywhere except banned countries. No country has ever been banned. Every transfer must still be declared.

The decree of 3 June 2026 creates the National Cybersecurity Agency (Milli Kibertehlukesizlik Agentliyi) as a public legal entity. It is the legal successor of the Electronic Security Service and 'operating in the field of protection of personal data'. Its charter lists, among others: running the state registration and state register of personal data resources and systems (clause 3.1.25); looking into complaints from people whose rights were breached by unlawful collection, use or poor security of their personal data (3.1.24); requiring breaches of the Law 'On Personal Data' to be fixed (3.1.28); joint inspection of registered systems against their declared purposes (3.1.29); auditing owners and operators on request (3.1.30); and taking action under the Code of Administrative Offences where it finds an offence (3.1.26). Some systems are left out. Those are the systems of top-category state bodies, of bodies protecting guarded persons and strategic objects, and of intelligence and counter-intelligence bodies. Personal data classified as a state secret is also left out. Separately, the Computer Incident Response Centre of the Special Communication and Information Security State Service, at cert.gov.az, is active and publishing. The Central Bank runs FinCERT for the financial sector, with its own portal for high-severity incidents. One warning about day-to-day status. The register site still names the abolished Electronic Security Service and gives a registry@cert.az contact address. Government pages have not all caught up with the June 2026 reorganisation.

Deletion rules. Article 9.4 of the Law 'On Personal Data' requires destruction without delay once two things are true. You have achieved the purposes for collecting and using the data. And you no longer need to store it. Article 9.8 requires sensitive data to be blocked and destroyed without delay once the ground for holding it falls away, unless the person agrees to storage or archiving. Article 15.6 requires immediate blocking and destruction where state registration of the system is cancelled. Article 5.10 leaves archiving rules to separate archive legislation. Minimum keeping periods. Article 20-12.6 was added by Law No. 454-VIIQD of 14 July 2026. The research centre must keep the record and results of a digital investigation, plus the supporting documents, for not less than 3 years. Article 9.12 of the personal data law requires control and audit logs to be kept, but sets no period. We did not verify general tax and accounting minimum periods in this pass, so they are on the unconfirmed list.

The Law 'On Personal Data' has no article on reporting breaches. Article 5.8 requires technical and organisational measures against accidental and unauthorised destruction, loss, unlawful interference and alteration. It attaches no duty to tell anyone. The Cabinet-approved Requirements for the Protection of Personal Data require you to detect unlawful interference in good time and to write an internal finding after a confidentiality breach. Again, nothing has to be reported outside. The incident deadlines come from Law No. 454-VIIQD of 14 July 2026. Article 20-9.1.8 requires cyber threat, attack and incident information to go to the National Computer Emergency Response Team immediately, with statistics kept and analytical reports filed quarterly. Article 20-9.1.2 gives 24 hours for proactive cybersecurity research requests and 5 working days for digital investigation requests. Article 20-10.9 sets the same 24-hour and 5-working-day deadlines for internet providers, hosting providers and owners of internet information resources. The National Cybersecurity Agency has been named as the National Computer Emergency Response Team.

(1) Article 15.2 of the Law 'On Personal Data' bars collecting or using data in a system that should be registered but is not. Article 15.4 gives the authority one month to register it. Cabinet Decision No. 237 of 17 December 2010 exempts state secret systems, employee records and site-access systems. It also exempts a set of categories, but only while they hold fewer than 1,000 people. So an ordinary customer database is usually covered. (2) The Requirements for the Protection of Personal Data set out 23 mandatory measures at clause 2.1. They are numbered. 2.1.17: the data centre archive system must sit in a separate building. 2.1.21: encryption key length not less than 256 bits. 2.1.18: licensed software only. 2.1.20: users must reach the system through their own protection servers. 2.1.23: state review of the system's design documents. Controlling bodies check compliance at least once a year. (3) Article 10.5 of the personal data law puts three duties on the operator. Create the conditions for intelligence, counter-intelligence and operational search measures. Sort out the organisational and technical issues. And keep the methods used confidential. (4) Article 375 of the Code of Administrative Offences sets 300 to 500 manat for using an unregistered system and for failing to secure or destroy data. Article 379 sets 3,000 to 4,000 manat on companies for using an uncertified information system or database. (5) Article 9.14 says that building personal data resources, creating information systems and providing services to them may be done only under a special permission (licence). We found no licence scheme matching this, so it reads as text on the books that nobody runs.

Law No. 431-VIIQD of 30 June 2026 amends the Information Law, the Law on Protection of Children from Harmful Information and the Code of Administrative Offences. Article 4.1 says the law starts twelve months after the day it is published. The presidential decree putting it into effect is dated 5 August 2026, so it starts around August 2027. Before it starts, providers must have the technical means for age checks in place and must tell the designated body (article 4.2). After it starts, they must block and delete accounts of under-16s who cannot prove their age (article 4.3). Age-check data may not be stored in the provider's own system. It may not be passed to third parties. It may not be used for commercial or targeted advertising. It must be deleted the moment the check finishes (articles 13-4.8 and 13-4.9). Penalties under article 13-5.6 run in steps: a written warning, then 100,000 manat (about 59,000 US dollars), then 300,000 manat (about 176,000 US dollars). Next comes a ban on state bodies and Azerbaijani taxpayers advertising on the platform. Then a court orders traffic slowed by 20 per cent, then 50 per cent, then 90 per cent. New article 388-4 of the Code of Administrative Offences adds fines on companies of up to 40,000 manat (about 23,500 US dollars). Four things can change without warning or consultation. The list of platforms caught by the age rule is set by a body the executive picks. The government may at any time treat a named country as failing the article 14.2 protection test, because nothing has to be published. The National Cybersecurity Agency's charter lets it restrict a seller's activity in the country for e-commerce disclosure failures. And the list of internet resources carrying prohibited information, which providers must block immediately, is decided administratively.