Personal Data Protection in Azerbaijan: What Businesses Must Do

Short answer: Companies' handling of personal data in Azerbaijan is governed by the Law "On Personal Data" No. 998-IIIQ of 11 May 2010. Data may be processed only on a lawful ground, most often the data subject's written consent, which can also be given as an electronic document with an enhanced e-signature (Articles 8 and 9.6). A subject's request must be answered within 7 business days (Article 12.4). Where an information system must be registered with the state, no data may be collected until it is (Article 15.2). Under Article 375 of the Code of Administrative Offences, owners and operators face fines of AZN 300–500.

Key concepts, legal grounds and consent

Personal data is any information that allows a person to be identified directly or indirectly (Article 2.1.1). That includes a customer's name and phone number, CRM history, an employee's personnel file and CCTV footage. The person the data relates to is the data subject (Article 2.1.2). The company that decides the purpose of processing is the owner (Article 2.1.9). Whoever actually processes the data is the operator. That can be the company itself or a hosting, CRM or accounting contractor engaged under a contract (Articles 2.1.10 and 9.9). A person's first name, surname and patronymic are permanently public (Article 5.3). Confidential data may be disclosed to third parties only with consent, unless the law provides otherwise (Article 5.2).

Processing is allowed on only four grounds (Article 9.6):

• the subject has consented, or the data is public;
• the processing is based on legislation;
• the data is anonymised for scientific or statistical purposes;
• the processing is needed to protect life or health.

Consent must be given in writing or as a document signed with an enhanced e-signature (Article 8.1). It must state (Article 8.2):

• who the subject is, and who the owner or operator is;
• the purpose of processing;
• which data will be processed and which operations will be carried out;
• how long the consent lasts and how it can be withdrawn;
• how the data will be destroyed or archived once the retention period ends.

The burden of proving that consent was obtained lies with the owner or operator (Article 8.4). Amendments made in 2024 also added a mechanism for giving and withdrawing consent through the E-Government Information System (Article 8.6).

Special category data means information on racial or ethnic origin, family life, religious beliefs, health and criminal convictions (Article 2.1.6). Processing it is generally prohibited. The exceptions include processing that is mandatory by law, the subject's written consent and the need to protect life (Article 9.7). Biometric data, such as fingerprints, facial images, voice and signatures, is subject to the Law's collection and processing conditions in full (Article 9.5). Companies that use facial recognition or fingerprint access control should take this into account.

Data subject rights and response deadlines

Subjects have the right to (Article 7.1):

• learn whether data about them is held and what it contains;
• know the purpose and duration of processing and who receives the data;
• demand that the data be corrected or destroyed;
• demand a ban on further processing.

Unless processing is mandatory by law, a subject may object to it in writing. The objection does not need to give reasons, and the company must stop processing immediately (Article 7.2). Information must be provided free of charge (Article 12.1).

Subjects exercise these rights either with a written paper application accompanied by an ID document or with an electronic request signed with an enhanced e-signature (Article 7.5). A subject whose rights have been breached may complain to the competent authority or go to court and claim compensation for material and moral damage (Articles 7.4 and 10.1).

Security, registration of information systems and cross-border transfers

Security. The owner and operator must take technical and organisational measures that protect data against accidental or unauthorised destruction, loss, unlawful access and alteration (Article 5.8). Operations must be recorded in control and audit logs (Article 9.12). Once the purpose has been achieved, the data must be destroyed without delay (Article 9.4). The detailed technical rules are set out in the "Requirements for the Protection of Personal Data" approved by Cabinet of Ministers Decision No. 161 of 6 September 2010. They include:

• separation of access rights, with authentication;
• records of authorised users;
• use of licensed software;
• encryption with keys of at least 256 bits for data in transit.

Staff who handle personal data must sign a written non-disclosure undertaking (Article 5.5).

Registration. Personal data information systems must be registered with the state, and no data may be collected in a system that requires registration until it is registered (Articles 15.1 and 15.2). Some systems are exempt (Article 15.3):

• systems covering people in an employment relationship with the owner, such as HR and building access systems;
• cases defined by the competent authority according to the purpose of processing and the number of subjects.

The register is maintained by the Ministry of Digital Development and Transport. Whether a customer CRM or online shop requires registration should be assessed case by case.

Cross-border transfers. A transfer abroad is prohibited in two cases (Article 14.2): if it threatens Azerbaijan's national security, or if the recipient country does not protect the data to the level required by Azerbaijani law. A transfer may still go ahead regardless of the level of protection if the subject consents or if it is needed to protect the subject's life or health (Article 14.3). The owner and operator remain responsible for security during the transfer (Article 14.4). The Law contains no general data localisation rule requiring all data to be stored in Azerbaijan. However, the registration application must list the categories of data transferred abroad (Article 15.4.13).

Compliance checklist for your website and internal processes

1. Map your data: website forms, CRM, HR files, CCTV, marketing lists. Record the purpose, legal ground and retention period for each (Articles 9.1–9.4).
2. Publish a privacy notice stating who you are, the purpose and legal basis of processing, the level of protection, who receives the data and the subject's rights. You must give this information at the point of collection (Article 11.2).
3. Align consent forms with Article 8.2. Obtain separate consent for marketing and keep proof of every consent (Article 8.4).
4. Collect only what you need and remove unnecessary form fields (Article 11.1).
5. Sign operator agreements that set out data protection duties with hosting, CRM and accounting providers (Articles 9.9 and 10.3).
6. Set up a request procedure. Decide in advance who receives requests and how the 7-business-day deadline is tracked (Article 12).
7. Check whether registration is required and enter the system in the register where needed (Article 15).
8. Put security measures in place: access rights, audit logs, encryption and staff undertakings (Articles 5.5, 5.8 and 9.12).
9. Identify transfers abroad and cover them in your consent wording (Article 14).

A note on cookies: the Law "On Personal Data" has no specific cookie rules. If cookies or analytics tools collect data that can identify a person, the Law's general requirements apply. If you serve customers in the EU, the GDPR and EU cookie rules may apply separately. They are a separate regime, not a requirement of Azerbaijani law. Personal data compliance is also worth reviewing when acquiring a company; see our legal due diligence checklist. For the broader framework for foreign investors, see our guide to doing business in Azerbaijan.

Liability

Anyone who breaches the Law bears liability under Azerbaijani legislation (Article 19). Article 375 of the Code of Administrative Offences provides for a fine of AZN 300–500 on the owner or operator in two situations:

The fines are modest. In practice, the bigger risks are damages claims in court, demands to stop processing and the resulting harm to reputation.

Frequently asked questions

Do we need consent for a simple website contact form?
Yes, unless another legal ground applies. State the purpose next to the form and link to your privacy notice. Under Article 8.4, it is up to the company to prove that consent was given.

Do employee personnel files need to be registered with the state register?
No. Information systems covering people in an employment relationship with the owner, and systems needed for building access, are exempt from state registration (Article 15.3.2). The data protection duties still apply.

Can we store customer data on servers abroad?
The Law contains no general localisation requirement. However, the transfer must not threaten national security, and the recipient country must provide adequate protection. Otherwise you need the subject's consent (Articles 14.2–14.3). Sector-specific rules, for example in financial services, may impose additional requirements.

How long do we have to act on a deletion request?
You must respond within 7 business days (Article 12.4). If the data was previously passed to a third party, you must notify that party of the action taken within 3 business days (Article 12.5).

Is CCTV footage personal data?
Footage that allows a person to be identified is personal data (Article 2.1.1), and the Law specifically lists facial images as biometric data (Article 9.5). Set out in an internal policy the purpose of the cameras, how long footage is kept and who may access it.

How we can help

Affidacons audits how your company handles personal data and drafts privacy notices and consent forms that comply with Azerbaijani law. We also prepare operator and cross-border transfer agreements, assess whether your information systems need registration and set up procedures for handling data subject requests. Learn more about our technology and digital law services or contact us.

This article is general information and does not constitute legal advice. It is based on Articles 2, 5, 7–15 and 19 of the Law of the Republic of Azerbaijan "On Personal Data" (No. 998-IIIQ of 11 May 2010, as amended including in 2024), Article 375 of the Code of Administrative Offences and Cabinet of Ministers Decision No. 161 of 6 September 2010 (October 2026); legislation may change. Obtain advice on your specific circumstances before acting.