GPS and worker monitoring in Hviderusland: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Separate and specific consent from the worker for geolocation + detailed notice (Law 99-Z)

  Yesrequired

  The Belarusian model is based on consent; for GPS it is advisable to obtain separate and specific consent from the worker, with detailed notice (controller, purposes, list of data, duration, parties who process the data, rights). The exception for employment relationships covers the ordinary management of the relationship, not continuous GPS surveillance.

  Legge della Repubblica di Bielorussia n. 99-Z del 7 maggio 2021 sulla protezione dei dati personali (NPDPC)

• Prior authorisation or registration with an authority before installing

  It dependsonly in certain cases

  No general prior authorisation is required; registration in the register of operators is required only for high-risk categories (biometric/genetic data, special transfers, 100,000+ data subjects). An employer using GPS on its own staff normally stays below the threshold.

  DLA Piper, applicazione e sanzioni in Bielorussia

• Legal basis = as a rule, consent (consent-centric model, different from the GDPR)

  Yesrequired

  Unlike the GDPR, the main legal basis is the worker's consent, and a separate consent is needed for each purpose of the processing.

  GRATA, protezione dei dati e privacy dei dipendenti in Bielorussia

• No processing beyond the purpose; consent for each purpose

  Yesrequired

  Processing must be limited to the declared purposes, with a separate consent for each; the controller must inform the workers and stop the processing when the legal basis no longer applies.

  GRATA, protezione dei dati e privacy dei dipendenti in Bielorussia

• Impact assessment (DPIA)

  Nonot required

  Belarusian law does not provide for a GDPR-style impact assessment; it does, however, require a data protection officer and notification of breaches within 3 working days.

  DLA Piper, applicazione e sanzioni in Bielorussia

The procedure, step by step

1. 1

   Collect the worker's separate and specific consent for geolocation.

2. 2

   Provide detailed notice (controller, purposes, list of data, duration, parties who process the data, rights).

3. 3

   Check whether you fall within the thresholds for registration in the register of operators (high-risk data).

4. 4

   Appoint a data protection officer and set up the notification of breaches within 3 days.

5. 5

   Limit the processing to the declared purposes and stop it when the legal basis no longer applies.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge della Repubblica di Bielorussia n. 99-Z del 7 maggio 2021 sulla protezione dei dati personali (NPDPC)
• NPDPC (Garante bielorusso), informazioni e contatti
• GRATA, protezione dei dati e privacy dei dipendenti in Bielorussia
• DLA Piper, applicazione e sanzioni in Bielorussia
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo lontano