Must personal data stay in Azerbaijan?

The main text is the Law on Personal Data No. 998-⁠IIIQ of 11 May 2010, amended in 2014 and 2018. We read it as it stood in October 2026. The short answer: the law does not require every system to keep all its data in the country, but it sets clear conditions for transfers abroad and requires personal data systems to be registered with the state.

What the law says

• Article 14: a transfer abroad is prohibited if it threatens Azerbaijan’s national security or if the receiving country’s law does not protect the data at the same level.
• The same article: with the person’s consent, or to protect their life and health, a transfer is allowed whatever the level of protection.
• Article 15: personal data information systems must be registered with the state; collecting and processing without registration is prohibited outside the exceptions the law lists.
• The owner or operator is responsible for the data’s safety during a transfer.

Why bank and public-sector projects still choose Baku

Banks and public-sector contractors often require servers in Azerbaijan in their own security policies and tender terms. That keeps audits simple: nobody has to prove how well another country’s law protects the data. Since 2022 every banking, public-sector and healthcare project of ours has run in Baku data centres or on the client’s own servers.

What we do on a project

• In the first two weeks we list what personal data the system keeps and where it sends it.
• Databases and backups stay in the country, and backups are encrypted.
• Names, personal ID codes and phone numbers are kept out of logs and analytics.
• When an outside service is needed, such as e-mail delivery, either no personal data goes to it or the person’s consent is collected.

This article is not legal advice. Check with your lawyer which rules apply to your project; the official text of the law is on e-qanun.az.

The details are as of the article’s date.