Belarus Law No. 99-Z on Personal Data Protection

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	BY 99-Z
Region	Europe
Country or scope	Belarus
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers BY 99-Z

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`BY-99Z-17` Technical and Cryptographic Protection Measures	Operators must apply technical and cryptographic measures to protect personal data against unauthorized access and modification; cryptographic integrity hashes on software components evidence this safeguard (Law 99-Z Art. 17)	Scan
`BY-99Z-17-DOC` Documented Processing Policies	Operators must adopt and publish documents defining their personal data processing policy; a formally identified, timestamped software inventory supports documented processing (Law 99-Z Art. 17 documentation duties)	Scan
`BY-99Z-7` Authorized Person Processing	Processing performed by an authorized person on the operator's behalf must be governed by an agreement ensuring equivalent protection, requiring the operator to know the suppliers of the software it relies on (Law 99-Z authorized-person provisions)	Scan
`BY-99Z-INV` Processing System Inventory	The operator's duty to organize and control processing presupposes knowing which software systems and components process personal data (Law 99-Z operator obligations)	Scan
`BY-99Z-BREACH` Breach Notification Readiness	Operators must notify the National Personal Data Protection Center of data protection breaches within three working days, which requires rapidly identifying the affected components and their versions (Law 99-Z breach-notification obligation)	Scan

All 22 from the standard set, adapted to BY 99-Z.