Trains models, in Montenegro

Law on Copyright and Related Rights, Rights of Makers of Databases, Arts. 139-145b, Official Gazette of Montenegro Nos. 37/2011, 53/2016, 145/2021, 48/2024, 84/2024 and 100/2024 · Read the law's page

• Do not extract or reuse all or a substantial part of a database's contents without the maker's authorization where the maker has made a substantial investment in obtaining, verifying or presenting them.
• Do not repeatedly and systematically extract or reuse insubstantial parts of a database's contents where doing so runs against the database's normal use or unreasonably harms the maker's legitimate interests.
• A lawful user of a database made available to the public may not act in a way that conflicts with its normal exploitation or unreasonably prejudices the maker's legitimate interests.

Official Gazette of Montenegro, No. 21/2023

• Do not subject individuals to decisions based solely on automated processing that have significant effects on them.
• Provide individuals with meaningful information about the logic of automated processing that affects them.

Law on Information Security, Arts. 1 to 3, 7 to 15 and 18(1) to (3) · Read the law's page

• This binds you if you access or process data, or use and manage a network and information system, in Montenegro, whether you are a business, another legal entity or a natural person, and regardless of your sector or size (Article 2).
• Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).
• Physically secure the premises, spaces and devices that house your network and information system (Article 14).
• Protect the confidentiality, integrity and availability of the data you process, store or transmit through the planning, design, construction, use, maintenance and decommissioning of that system (Article 15).
• Designate an employee to monitor your compliance with these measures (Article 18(3)).

Law on Information Security, Arts. 28 to 37 · Read the law's page

• Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).
• Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).
• For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).
• For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).
• This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).