Personal Data Management
Licensed personal data operator for regulated Azerbaijani companies.
Azerbaijan's Law On Personal Data sets duties for companies that hold personal data. They include audit logs, retention limits, answers to data subjects and state registration of the systems that store the data.
Webiland is a licensed personal data operator. Under a written operator agreement, we collect, process and protect your data on our own servers in Baku. You remain the owner and decide why the data is processed.
What the data says
The law sets who may run personal data systems, how fast a person must get an answer, and how data in transit must be encrypted.
Building personal data resources and information systems, and providing services to them, is allowed only under a special permit (licence).
Law No. 998-IIIQ (2010), Art. 9.14the legal deadline for a data owner or operator to answer a person's request about their own data. It can be extended by 7 more business days if a third party must be asked.
Law No. 998-IIIQ (2010), Art. 12.4the minimum key length for the encryption used to transfer information from systems that process personal data
Decision No. 161 (2010), point 2.1.21Independent data. Each figure links to its original source.
Who it is for
Regulated companies with customer data
Banks, insurers, healthcare providers and retailers that hold customer data and want the operator duties set out in a contract with a licensed operator.
International companies with an Azerbaijani entity
Groups whose local company collects personal data in Azerbaijan and must meet Azerbaijani law, not only the rules of the head office.
Clients whose system we built
Companies running a system Webiland built that processes personal data. The team that built it can also operate it, under one contract.
What's Included
Operator agreement
A written contract under Article 9.9 of the law. It lists the data categories, purposes, retention periods, access rules and your audit rights.
Storage on our own servers in Baku
Data processed under the agreement is stored on Webiland's own servers in Baku, not on a foreign cloud platform. Transfer abroad is available as an option, only where Article 14 of the law allows it.
Access control and audit logs
Access is granted by role. Collection, processing, requests and admin actions are written to audit logs, as Article 9.12 of the law requires.
Retention and deletion
Your retention periods are enforced on schedule. Data is deleted once its purpose is met, as Article 9.4 requires.
Requests from data subjects
Requests to see, correct or delete personal data are answered within 7 business days, the deadline that Article 12.4 sets.
Incident response
Unlawful access is detected, investigated and written up. You are told what happened and what was done to limit the harm.
Our Process
Data Mapping & Scoping
We identify what personal data your organisation collects, on what legal basis, for what purpose, and how long it must be kept.
Operator Agreement
We draft and sign the operator agreement. It sets our duties as operator, as Article 10.3 of the law provides.
Infrastructure Onboarding
Data is moved to, or first collected on, our own servers in Baku. Access roles are set up and audit logging is switched on.
Operational Handoff
Your team works with the data through agreed interfaces. We run the infrastructure and carry out the operator duties in the agreement.
Ongoing Operations
Monitoring, backups, retention, access reviews and updates when the law changes. The agreement is reviewed on a schedule written into it.
Frequently Asked Questions
Ready to get started?
Tell us about your project. We research before we quote, and you receive a written scope and an itemized estimate — no guesswork, no invoice for the thinking.
- Scope agreed in writing
- Full IP ownership
- Reply within one business day