Belarus

Art. 17(3) requires public authorities, legal persons and other organisations to appoint a data protection officer or set up a dedicated unit as one of the mandatory protection measures.

Art. 5 defines consent as freely given, unambiguous and informed, and puts the burden of proving it on the operator. The operator must act on consent withdrawal within 15 days (Art. 10), answer information requests within five working days and rectification requests within 15 days (Art. 11), answer requests for third-party transfer information within 15 days (Art. 12) and act on erasure requests within 15 days (Art. 13).

Art. 16(1) requires the operator to notify the authorised agency of a breach immediately and no later than three working days after becoming aware of it. The English text on cpd.by does not name the National Centre as that agency (Art. 18(5)).

Art. 6(1) requires identification records and related documents to be kept for at least five years after written financial-operation contracts end; where there is no contract, the five years run from the date of the transaction.

Point 2.3 requires operators to hold at least 1 million Belarusian roubles (crypto platform operator) or at least 200,000 roubles (crypto exchange operator) in Belarusian bank accounts.