GDPR vs. Regolamento sulla protezione dei dati armeni: differenze critiche e strategie di conformità

Armenian data protection law and the GDPR part company most sharply on two points: sending data abroad and penalties. A transfer from Armenia to a country outside the Agency’s 53-entry adequacy list needs the Agency’s prior permission, decided within 30 days, and administrative fines run from AMD 50,000 to AMD 500,000 (about USD 138 to USD 1,384 at the firm’s house rate of AMD 361.36 per USD, the Central Bank of Armenia rate of 19 October 2026), against the GDPR’s ceiling of EUR 20 million or 4% of worldwide annual turnover. The Armenian statute is the Law on Protection of Personal Data (HO-49-N of 18 May 2015), most recently amended by HO-447-N, in force since 4 January 2026, and HO-191-N, which takes effect three months after its publication on 14 May 2026, so about mid-August 2026.

Armenian law also uses different words for the same roles. The Armenian processore (մշակող) is the party that decides why and how data is handled, the role the GDPR calls the controller. The party that handles data on its behalf is the persona autorizzata (լիազորված անձ), the GDPR’s processor. A contract drafted with GDPR terms should map them expressly.

GDPR and Armenian law side by side

Sending HR or customer data abroad

Article 27 of the Law answers two separate questions about every transfer out of Armenia. The first is whether the organisation may transfer the data at all: Article 27(1) allows it with the data subject’s consent or where the transfer is necessary for the purposes of the processing. The second is whether the destination needs a permit, and that depends on the country.

Countries that need no permit

Under Article 27(2), no permission is needed where the receiving state ensures an adequate level of protection. It does so if the transfer is made under an international treaty, or if the country appears on the list the Agency publishes officially. Article 27(5) requires the Agency to review that list at least once a year.

By decision ԱՏՊԳ-001/26 of 18 June 2026 the Agency approved a new list of states ensuring adequate protection. It has 53 entries, and the United States entry covers organisations only, not the country as a whole. The decision enters into force on the day after its official publication. An earlier list, approved by decision ԱՏՊՊ-001/24 of 8 July 2024, also had 53 entries; the 2026 decision contains no clause repealing it, and the 2026 list is the one most recently approved under Article 27(5). Check the destination country against the current list on the Agency’s website before each new data flow.

Countries that need the Agency’s permission

A transfer to a state without adequate protection may take place only with the Agency’s permission, and only on a contract whose safeguards the Agency has approved as sufficient (Article 27(3)). The steps under Article 27(4):

1. Prepare the contract with the foreign recipient, including the safeguards for the data.
2. Apply to the Agency in writing before the transfer, naming the country, the recipient, the categories of data, the purposes and the contract.
3. The Agency must allow or refuse the transfer within 30 days. It may ask for more information within that period.
4. If it finds the safeguards insufficient, it must state what has to change.

The Law does not say that silence after 30 days counts as approval, so do not start the transfer until you hold the decision. A signed contract does not replace the permission. Whether the data subject’s consent alone could make a transfer to a non-listed country lawful without permission is not settled by the text; plan on the permission route for any destination off the list.

HR data to a parent company, customer data to a foreign platform

Sending payroll and HR files to a foreign parent, or customer records to a CRM or support tool hosted abroad, are the most common transfers out of Armenia. The answer depends on the facts, and these are the questions that decide it:

• Where is the recipient’s server, and where are its sub-processors? A platform’s hosting country can differ from the provider’s head-office country.
• Is that country on the Agency’s current list? For a United States recipient, is the recipient an organisation within the scope of the US entry?
• If the country is not listed, has the Agency approved the contract and granted permission?
• What is the basis for the transfer under Article 27(1): the employee’s or customer’s consent, or necessity for the purpose of the processing? Record it.
• Is the foreign recipient handling the data on your behalf? If so, it is your authorised person and needs the written instruction described below.

Data coming from the EU into Armenia

Article 27 governs data leaving Armenia. Data sent from the EU to Armenia falls under Chapter V of the GDPR on the EU side. The European Commission has not adopted an adequacy decision for Armenia, so the EU exporter normally relies on standard contractual clauses under Article 46(2)(c) GDPR. That assessment belongs to the exporter and its EU counsel; the Armenian recipient’s part is to sign the clauses and be able to meet them. Our checklist for Armenian suppliers answering a customer security questionnaire covers what EU customers usually ask for.

Legal basis and consent

Article 8 makes the data subject’s consent the default basis for processing, except where the Law or another law expressly provides otherwise, and permits processing of data from publicly available sources. Article 9(4) lists cases where consent is deemed given, including where data is used for the purposes of a contract with the person. The text contains no general legitimate-interests basis of the kind GDPR Article 6(1)(f) offers, so a business that relies on legitimate interests in the EU should identify a different Armenian basis for the same processing.

Consent may be given in writing, electronically with an electronic digital signature, or orally where the person’s conduct reliably shows agreement (Article 9(7)). The organisation bears the burden of proving it (Article 9(8)), consent can be withdrawn (Article 9(3)), and for a child under 16 the legal representative gives it (Article 9(9)). In practice, oral consent is hard to prove, so record consent in a form you can produce later. Our guide to lawful bases and consent requirements in Armenia covers the exceptions in more detail.

For employees, the firm’s employment guidance treats written consent to personal-data processing as part of the internal labour rules, alongside the employment contract. See our servizio di conformità in materia di lavoro for audits of HR documentation.

Using a service provider: the written instruction

When an Armenian organisation has another party process data for it, Article 14(2) requires a written instruction to that authorised person, with the content the Law lists. Under Article 14(3), if the instruction does not comply with the Law, the authorised person must tell the organisation in writing and refuse to carry out the processing. For a foreign group, this means the GDPR Article 28 agreement used in the EU should be checked against Article 14 before it is used for an Armenian entity, both where the Armenian company hires a provider and where it acts as the provider.

violazioni dei dati

Article 21(4) of the Law provides that where personal data leaks from electronic systems, the organisation must immediately publish an announcement about it, and at the same time report the leak to the Police and to the Agency. The text sets no number of hours; “immediately” is the standard. The GDPR, by contrast, requires notice to the supervisory authority within 72 hours unless the breach is unlikely to put individuals at risk.

A business holding data on both EU and Armenian individuals therefore needs an incident plan with two tracks: the Armenian announcement and reports, which come first, and the GDPR notice within 72 hours. Draft the announcement template in advance.

Separate incident rules apply to operators in vital sectors under the Cybersecurity Law (HO-442-N), described below. Whether that Law reaches an ordinary IT or outsourcing supplier depends on its sector and on subordinate acts not yet in force, so check scope case by case.

Notifying the Agency

Armenia has no general registration duty for organisations that process personal data. Under Article 23, an organisation may notify the Agency before it starts processing; it must notify if the Agency demands it, and it must notify before processing biometric data or special categories of data. The Agency enters a notification in its register within 30 days of receiving it, and changes to notified information must be reported within ten working days.

Data protection officers, impact assessments and sector rules

The current Law contains no general duty to appoint a data protection officer or to carry out a data protection impact assessment. Two sets of sector rules impose comparable duties:

• Financial sector. Central Bank Board decision 173-N of 9 July 2013 requires banks, regulated-market operators, the central depository, credit bureaus, leverage and forex providers, crowdfunding operators, insurers and payment and settlement organisations to assign information security to a responsible person, unit or outsourced provider, to analyse and assess information-security risks, and to keep and analyse electronic logs.
• Vital sectors. The Cybersecurity Law HO-442-N (adopted 4 December 2025, published 25 December 2025) requires entities in vital sectors that operate an information system or critical infrastructure to appoint a cybersecurity specialist, unless cybersecurity is fully outsourced. The 14 vital sectors include financial services, health, communications, IT and database management. Micro and small enterprises are excluded unless they operate critical infrastructure. Its provisions apply only once the subordinate acts are adopted, with 18 months allowed for internal rules, risk assessment and prevention plans, and logs must be kept for at least three years.

A draft package of laws published for discussion as e-draft 10533 would introduce data protection impact assessments and data protection officers and restructure the supervisory authority. It is a proposal under discussion and does not bind anyone today. Our page on data protection for IT, healthcare and financial services covers the sector angle.

sanzioni

Article 189.17 of the Code of Administrative Offences sets the fines for data protection violations in eight parts. Each fine is a multiple of the statutory base of AMD 1,000, and across the article they range from AMD 50,000 to AMD 500,000 (about USD 138 to USD 1,384 at the firm’s house rate of AMD 361.36 per USD, the Central Bank of Armenia rate of 19 October 2026). Under part 8, the organisation is released from liability if it remedies the violation within the period set by the Agency, or before the decision on liability, and provides evidence of the remedy.

Article 204 of the Criminal Code makes certain unlawful handling of personal data a criminal offence. Whether a particular incident meets the elements of that offence depends on the facts.

The GDPR’s two tiers, up to EUR 10 million or 2% of worldwide annual turnover and up to EUR 20 million or 4%, apply to EU processing regardless of what an Armenian affiliate risks locally.

A compliance plan for a business under both regimes

1. Map each data flow, including where each recipient and sub-processor stores data.
2. For every flow out of Armenia, check the destination against the Agency’s current adequacy list; apply for permission on an approved contract for any country not on it, before the transfer.
3. For every flow from the EU into Armenia, confirm the EU exporter’s transfer tool, normally standard contractual clauses.
4. Replace any reliance on legitimate interests with an Armenian basis: consent in a provable form, a contract, or a statutory ground.
5. Issue Article 14 written instructions to every authorised person handling Armenian data, and align them with your GDPR Article 28 terms.
6. Notify the Agency before processing biometric or special-category data.
7. Prepare a breach plan with the Armenian announcement and reports to the Police and the Agency first, and the GDPR 72-hour notice in parallel.
8. If you operate in finance or a vital sector, add the Central Bank or Cybersecurity Law duties on security staff, risk assessment and logs.

For foreign companies setting up in Armenia, our guide to key requirements of the Personal Data Protection Law for foreign companies e il nostro servizio di registrazione aziendale cover the steps around incorporation. Detailed compliance support is described on our data protection compliance page.

Domande frequenti

Ultimo aggiornamento: 11 novembre 2026