🇦🇲

Armenia

Law on Protection of Personal Data (2015)

Europe🔵 Substantial

Compliance Score

36%

5 Addressed

7 Partial

2 None

Authority

Personal Data Protection Agency, Ministry of Justice

Overview

Armenia’s Law on Protection of Personal Data (HO-49-N), adopted on 18 May 2015 and in force since 1 July 2015, establishes a comprehensive framework for personal data processing supervised by the Personal Data Protection Agency under the Ministry of Justice . The law does not impose a general data localisation requirement, but it regulates cross-border transfers through a tiered mechanism: transfers to countries that have ratified the Council of Europe Convention 108, or that appear on the Agency’s officially published adequacy list, proceed without prior authorisation . Transfers to countries lacking adequate protection—including Japan, which is not on Armenia’s adequacy list—require either the data subject’s explicit consent or the Agency’s prior approval based on contractual safeguards deemed sufficient by the regulator . The Agency reviews authorisation applications within 30 days and may request additional information or specify required contractual amendments . Processors of biometric and special-category data must notify the Agency before processing, with administrative penalties for non-compliance . Armenia is currently undergoing an EU-supported analysis of its data protection framework, signalling potential future reforms .

14-Topic Coverage Analysis

Data Protection Authority

Addressed

Consent Requirements

Addressed

Data Subject Rights

Addressed

Cross-Border Transfer

Addressed

Breach Notification

Partial

DPO Requirements

Partial

Children's Data

Partial

Penalties & Enforcement

Addressed

Sector-Specific Rules

Partial

Cookie/Tracking

Partial

AI & Automated Decisions

None

Data Localisation

Partial

Significant Data Fiduciary

None

Government Data

Partial

? Frequently Asked Questions

What are the data localisation rules in Armenia?+

Armenia does not have a general data localisation mandate. However, the law requires that cross-border transfers only happen to countries with 'adequate' protection. The Ministry of Justice maintains a list of such countries.

Does Armenia require a Data Protection Officer (DPO)?+

Partially. The Law on Protection of Personal Data (2015) may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.

What are the breach notification requirements in Armenia?+

Armenia's law has limited breach notification requirements. It may only require notifying the regulator (Ministry of Justice) without explicitly mandating notification to affected individuals.