Security in Armenia
The processor has an obligation to destruct or block personal data that are not necessary for achieving the legitimate purpose.
In the course of processing personal data, the processor shall be obliged to use encryption keys to ensure the protection of information systems containing personal data against accidental loss, unauthorized access to information system, unlawful use, recording, destructing, altering, blocking, copying, and disseminating personal data and other interference.
The processor is obliged to prevent the access of appropriate technologies for processing personal data for persons not having a right thereto and ensure that only data, subject to processing by him or her, are accessed by the lawful user of these systems and the data which are allowed to be used.
The requirements for ensuring security of processing of personal data in information systems, the requirements for tangible media of biometric personal data and technologies for storage of these personal data out of information systems shall be prescribed by the decision of the government of the Republic of Armenia. In case another body exercising control is prescribed by law, this body, within the scope of powers reserved to it by law, may prescribe higher requirements other than those provided above.
Use and storage of biometric personal data out of information systems may be carried out only through such tangible media, application of such technologies or forms, which ensure the protection of these data from the unauthorized access thereof, unlawful use, destruction, alteration, blocking, copying, dissemination of the personal data, etc.
Processors of personal data or other persons provided for by this law shall be obliged to maintain confidentiality both in the course of performing official or employment duties concerning the processing of personal data and after completing thereof.
The control over the fulfillment of the above-mentioned requirements shall be exercised by the authorized body for the protection of personal data without the right to process personal data being processed in the information systems.
Legal persons processing personal data, for having recognized electronic systems for processing the personal data under their possession as having an adequate level of protection and including them in the register, may apply to the authorized body for the protection of personal data.
