Hiring a senior developer in Minsk. The standard playbook from back home kicks in. Identity verification. Prior employment confirmation. Criminal record check. Social media review. Maybe a credit check for a senior position. You\u2019ve done this a hundred times. Then the recruiter sends back a polite note. Most of that isn\u2019t allowed under Belarusian law for an IT role. The criminal record check is reserved for specific regulated positions \u2014 software developer isn\u2019t one of them. The consent form needs statutory language you don\u2019t have. And the \u201clegitimate interest\u201d basis you\u2019d lean on under GDPR doesn\u2019t exist as a legal basis under Belarusian data protection law at all.<\/p>\n\n\n\n
Welcome to the gap between what feels like normal hiring due diligence and what Belarusian law actually permits. It\u2019s wider than most foreign IT employers realise. It\u2019s also entirely workable, once the framework is designed around it rather than retrofitted after the first candidate quietly declines and walks away.<\/p>\n\n\n\n
Below: the legal framework that actually applies, what Belarusian law permits and what it doesn\u2019t, the criminal record check question that catches almost every foreign client at kickoff, the cross-border data transfer issue that catches EOR setups, and the practical alternatives that produce better hiring decisions than US-style document screening ever did. Plus two possible cases from practice \u2014 including one where the playbook had to be torn up after six weeks of wasted recruitment effort.<\/p>\n\n\n\n
Three pieces of Belarusian legislation control what an employer can and can\u2019t do when screening candidates. Foreign IT employers typically know about none of them at the kickoff call. Worth getting straight before the first job offer goes out.<\/p>\n\n\n\n
Article 26 lists the documents an employer can require from a candidate. The list is finite. Passport (or other ID). Employment record book. Education certificate. Military registration documents where applicable. Social insurance certificate. That\u2019s essentially it. Anything outside this list \u2014 including criminal record certificates for a general IT role \u2014 needs a specific legal basis. You can\u2019t add documents to the list as a contractual condition just because your global HR policy says so.<\/p>\n\n\n\n
Law No. 99-Z of 7 May 2021. GDPR-structured, but materially different in critical respects. The biggest difference for employment screening: legitimate interest isn\u2019t a legal basis for processing personal data under Belarusian law, the way it is under GDPR. Consent is the practical foundation for almost everything an employer does beyond what Article 26 directly requires. The law reaches Belarusian and foreign employers handling Belarusian residents\u2019 personal data \u2014 extraterritorial in the same way as GDPR is, with the same implications for offshore EORs and parent companies.<\/p>\n\n\n\n
The administrative framework. Supervisory authority is the National Personal Data Protection Center. Practical responsibilities for the data controller \u2014 your employer entity \u2014 include maintaining processing records, documenting consent, securing data transfers, and being able to demonstrate compliance on request. The Edict and its implementing acts are tracked on<\/p>\n\n\n\n
The Belarusian national legal portal<\/a>; the Center publishes its own guidance and supervisory materials at cpd.by<\/a>.<\/p>\n\n\n\n The operational core. What\u2019s permitted \u2014 with the right consent framework \u2014 for an IT role in Belarus. Read this carefully. The shape is narrower than you think going in, and broader than you\u2019d guess once you see it laid out.<\/p>\n\n\n\n Foreign IT employers ask for this constantly. Almost always inappropriate. Worth its own section because the mistake is so common, the legal exposure so avoidable, and the conversation so tedious to have on day one of every kickoff.<\/p>\n\n\n\n The Belarusian criminal record certificate comes from the Ministry of Internal Affairs. Around twenty working days to issue. Routinely issued to individuals for their own purposes: visa applications, immigration, foreign employment. The employer-side question is whether you can require it as a hiring condition.<\/p>\n\n\n\n For most IT roles, no.<\/p>\n\n\n\n This comes up in almost every kickoff conversation with a new foreign IT client. The instinct comes from US, UK, or German hiring practices where pre-employment screening is the cultural default and nobody questions it. In Belarus the default is narrower. The framework is workable \u2014 but \u201crun a criminal check on everyone\u201d isn\u2019t the route in, and trying to make it one creates problems faster than it solves them.<\/p>\n\n\n\n Less black-and-white than the criminal record question. Still tightly regulated. Worth understanding before the recruiter does what feels like normal due diligence and creates a problem nobody noticed.<\/p>\n\n\n\n The aspect that catches multinational employers and offshore EOR providers more than any other. Personal data of Belarusian residents flowing to a foreign parent, an offshore HRIS, a US-based recruitment agency, an EOR provider sitting elsewhere \u2014 all regulated under the PDP Law. None of this is optional.<\/p>\n\n\n\n The framework requires the destination jurisdiction to provide an \u201cadequate level of protection\u201d for data subjects\u2019 rights. Belarusian adequacy criteria aren\u2019t identical to GDPR\u2019s. Practical groupings:<\/p>\n\n\n\n Practical implication for foreign IT employers. If you\u2019re a US tech company hiring Belarusian developers through a Belarusian EOR, the background screening data flow has to be designed for adequacy from day one. Retrofit fixes are awkward. Experienced Belarusian recruitment partners build this into their workflows automatically. Our EOR and payroll services<\/a> are structured around exactly this compliance architecture \u2014 including the data-flow design for cross-border HR processes.<\/p>\n\n\n\n Where the article earns its keep. Real techniques that work within the legal framework \u2014 and that produce better hiring outcomes than the document-heavy screening foreign IT employers default to.<\/p>\n\n\n\n For IT hiring, this is the single most predictive signal you can generate. Hands-on technical assessments. Live coding interviews. System design discussions for senior roles. Take-home projects with realistic scope. Pair programming sessions with the team the candidate would join. Public GitHub review where the candidate has meaningful contributions. None of this touches the personal data framework. All of it is more predictive of actual on-the-job performance than any document review. Foreign employers underweight this. Belarusian employers don\u2019t.<\/p>\n\n\n\n Direct calls with prior managers, with the candidate\u2019s written consent and the prior employer\u2019s willingness to engage. Confirming employment dates, role, scope, reason for leaving. Asking specific behavioural questions instead of generic \u201cwould you hire them again\u201d prompts \u2014 which produce vague positive answers regardless of actual performance. Cross-checking the candidate\u2019s narrative against multiple independent reference points. Allowed. Works. Underused because it takes time.<\/p>\n\n\n\n Article 26 document review handles identity and prior Belarusian employment. For credentials, verify directly with the issuing body \u2014 Microsoft, AWS, Google Cloud, ISTQB, vendor certification authorities. Education verification through the university. LinkedIn cross-check on dates, roles, scope using publicly accessible content. All inside the framework.<\/p>\n\n\n\n Belarusian labour law allows probation periods of up to three months for most positions. Sophisticated Belarusian IT employers treat the probation period as the real background check \u2014 actual performance on actual work, which is more predictive than any document. The employer can terminate during probation with three days\u2019 notice and minimal documentation. Build the probation period into your hiring framework deliberately and you get the equivalent of due diligence without the personal data exposure. Most foreign clients underuse this. The ones who get it right structure performance milestones at thirty, sixty, and ninety days, and treat the decision at day ninety as the real hiring decision.<\/p>\n\n\n\n Belarusian senior IT talent is a relatively small market. Senior developers in Minsk are largely known quantities within the local community \u2014 references travel through industry networks rather than through formal channels. A local recruitment partner with established relationships can vouch for candidates based on long-term market knowledge no foreign recruiter can replicate. Concerns from prior placements surface naturally. Our IT recruitment service<\/a> and HTP recruitment specifically<\/a> are built around exactly this kind of local-market depth. Hard to retrofit; obvious in the results.<\/p>\n\n\n\n Brief but worth flagging \u2014 the firm\u2019s audience overlaps heavily with Hi-Tech Park residents.<\/p>\n\n\n\n Hi-Tech Park residency simplifies many HR processes and brings real tax benefits. It does not change the PDP Law framework. HTP residents handling personal data operate under the standard constraints \u2014 same consent requirements, same Article 26 limits, same cross-border transfer architecture. HTP\u2019s flexibility on labour terms (foreign worker hiring, contract types, remote work) doesn\u2019t extend to relaxing personal data processing rules. Some new HTP residents assume residency benefits cover this too. They don\u2019t.<\/p>\n\n\n\nWhat you can actually screen for<\/strong><\/h3>\n\n\n\n
Standard verification under Article 26<\/strong><\/h3>\n\n\n\n
\n
Permitted with proper consent<\/strong><\/h3>\n\n\n\n
\n
Requires specific statutory basis (not available for general IT roles)<\/strong><\/h3>\n\n\n\n
\n
The criminal record question \u2014 the mistake every foreign client makes<\/strong><\/h3>\n\n\n\n
\n
Social media checks <\/strong><\/h3>\n\n\n\n
\n
Cross-border data transfer \u2014 the thing that catches EOR setups<\/strong><\/h3>\n\n\n\n
\n
What actually works for IT hiring \u2014 the practical alternatives<\/strong><\/h3>\n\n\n\n
Technical screening as the primary signal<\/strong><\/h3>\n\n\n\n
Reference checks that actually work<\/strong><\/h3>\n\n\n\n
Identity and credential verification<\/strong><\/h3>\n\n\n\n
The probation period as your real safety net<\/strong><\/h3>\n\n\n\n
Working with an experienced local recruitment partner<\/strong><\/h3>\n\n\n\n
HTP-specific considerations<\/strong><\/h3>\n\n\n\n