Azerbaijan's personal data law: what it means for websites and apps

The law and the authority

The Law of the Republic of Azerbaijan "On Personal Data" was adopted on 11 May 2010 (No. 998-IIIQ). International legal overviews, such as DLA Piper's Data Protection Laws of the World, identify the Ministry of Digital Development and Transport as the primary regulator, with other state bodies involved in enforcement. The official text is available in legal databases; an English version is published, for example, in the ILO's NATLEX database.

Sources: NATLEX — Law No. 998-IIIQ on Personal Data, DLA Piper — Data protection laws in Azerbaijan.

Key concepts

• Personal data: any information that allows a person to be identified, directly or indirectly — names, phone numbers, emails, IP addresses in many contexts, photos, identification numbers.
• Owner and operator: the organisation that decides why and how data is processed, and the organisation that processes it on its behalf — similar to controller and processor in other laws.
• Open and confidential data: the law distinguishes data that is publicly available by the person's choice or by law from confidential data that requires protection.
• Special categories: data about race or nationality, family life, religion and beliefs, health and criminal convictions, which require particular care.

Consent

As a general rule, personal data may be collected and processed only with the person's consent, except where the law requires or permits processing without it. The owner or operator should be able to prove that consent was obtained. For websites this means:

• clear consent at the point of collection — for example, a checkbox on a form with a link to the privacy notice, not pre-ticked;
• separate consent for different purposes where appropriate — processing an enquiry is not the same as sending marketing messages;
• records of when and how consent was given;
• a simple way to withdraw consent.

Information systems

The law provides for the registration of personal data information systems with the competent authority, with exemptions. Whether your website, CRM or app database falls under this requirement depends on its nature and purpose; this is a question for your lawyer.

Transfers abroad

Using cloud services, international CRMs, analytics or AI providers often means that personal data is transferred outside Azerbaijan. The law sets conditions for cross-border transfers — commonly the person's prior consent, unless the data is in an open category — and may restrict transfers where the destination does not provide adequate protection. Map where your data actually goes: hosting, backups, email service, CRM, analytics, chat and payment providers.

Practical steps for a website or app

1. Inventory: list what personal data you collect, where, why and where it is stored.
2. Minimise: collect only what you need for each purpose.
3. Consent and notices: obtain consent where required and publish a clear privacy policy in Azerbaijani and your other site languages. See privacy policy for websites in Azerbaijan.
4. Security: encryption in transit, access control, logging, backups, secure development. See security audit.
5. Access: limit who in your team and your contractors can see personal data. See access management for teams.
6. Retention: define how long data is kept and delete it afterwards.
7. Requests: have a process for people who ask what data you hold or ask to delete it.
8. Vendors: check where your providers store data and what their terms say.

Sensitive businesses

Clinics, laboratories, schools, recruitment agencies, insurers and financial services process special categories or large volumes of personal data. They need stricter access control, careful choice of hosting and vendors, and legal review of every data flow. See, for example, private clinics.

International laws

If you serve customers in the European Union or other jurisdictions, their data protection laws — such as the GDPR — may also apply. Designing systems to meet strict standards from the start is usually easier than meeting several laws separately.