Data Protection Law contains a wide range of legal bases for personal data processing:

• data subject’s consent;
• if the processing is required for:
  • administrative or criminal proceedings, operational-search activities;
  • administration of justice and the enforcement of court orders and other enforcement documents;
  • performing monitoring activities (supervision) in accordance with the legislation;
  • implementation of legislation on national security, on combating corruption, on preventing money laundering, financing of terrorist activities and financing weapons of mass destruction proliferation;
  • the implementation of legislation on elections and referendum;
  • state social insurance purposes;
  • formalising employment relationships, in the process of employment activities;
  • notarial activities;
  • Belarusian citizenship issues;
  • assignment and payment of pensions, benefits;
  • the organisation and carrying out of national statistical observations;
  • scientific and other research purposes, on condition that the personal data are depersonalised;
  • accounting, calculation, charging of fees for housing and utility services, other services, taxes;
• processing is based on a contract, that is concluded (being concluded) with data subject, and for the purpose of performing actions stipulated by this contract;
• if personal data are specified in a document addressed to the operator and signed by the data subject;
• processing is essential for the performance of certain journalist’s activities;
• processing is required to protect the subject's life, health or other interests if obtaining of consent is not possible;
• if personal data were previously disseminated;
• in order to fulfil the duties / powers stipulated in legislation;
• in other cases expressly provided in legislation.

Data Protection Law has different list of legal bases for processing of special personal data and for cross-border transfer of personal data to the territories of states that do not ensure proper protection of data subjects rights.

The consent of the data subject can be obtained in writing, in the form of an electronic document or in another electronic form (e.g. via tick-box at the website or SMS / email verification). Operator shall provide proof, if be required, that it has collected proper consent for personal data processing.

Before obtaining consent, the operator shall provide the subject of personal data with the following information:

• name (full name) and location (address of residence) of the operator;
• purpose of personal data processing;
• list of personal data to be processed;
• consent validity term;
• information about the persons authorised by operator to process personal data (if those are engaged);
• what actions be done with personal data;
• a general description of the processing methods;
• other relevant information.

In addition, apart from other necessary information, the subject shall be informed of his/her rights, the mechanism for exercising them, the consequences of giving and withdrawing consent.

Operator may collect surname, first name, middle name of data subject, date of birth, identification number (if not, the number of the ID document) only if it is required for the purposes of processing. Such information shall be provided by data subject when at the time he/she provides the consent.