By January 15, 2024, operators must make entries about the information resource (system) being used in the register of personal data operators (hereinafter referred to as the register) if the personal data processing there meets at least one of the criteria:
- cross-border transfer of special personal data, if a foreign state is considered as not ensuring an adequate level of protection of the personal data subjects’ rights, exclusive where such a transfer is performed based on an international treaty or to protect the life, health or other vital interests of the personal data subject and it is impossible to obtain consent;
- processing of biometric and (or) genetic personal data (for example, test results, and photos of patient examinations are stored in the database of medical centers, or video surveillance is conducted in the organization, carrying out a comparison with employees’ photos stored in the organization's system);
- processing of personal data of more than 100 thousand individuals;
- processing of personal data of more than 10 thousand individuals under the age of 16.
Background: If the information resource (system) was created after January 1, 2024, then the information must be entered within 10 working days after its launch.
Information is entered into the register in electronic form on its website by specifying the operator's data and the criterion(criteria) meeting for inclusion. The registration is made with the operator's personal account authentication by using an electronic digital signature. There is no fee for entering information into the register. Any person can get information from it.
For failure to submit information to the register, administrative liability is provided under Article 24.11 of the Code of the Republic of Belarus on Administrative Offenses with a fine for an official (for example, a director) of up to 20 basic units (740 Belarusian rubles, approximately 230 US dollars).
