Processes personal data, in Bosnia and Herzegovina

Law on the Protection of Personal Data, Official Gazette of Bosnia and Herzegovina No. 12/25, applicable 4 October 2025, arts. 1-9, 13, 26-34, 37-45, 52-65 (excluding 57a-57b), 75-85, 88-90 (general provisions, lawful basis, controller and processor duties, security, DPIA, DPO) · Read the law's page

• Establish a lawful basis under Article 8 before processing personal data of a person in Bosnia and Herzegovina, and appoint a Data Protection Officer under Articles 39 to 41 wherever the processing meets the threshold the Act sets, such as processing carried out by a public authority or large-scale monitoring or special-category processing.
• Keep a written record of processing activities under Article 32, covering the purposes, the categories of data subjects and data, the recipients, any transfer abroad, and the envisaged erasure periods, and make it available to the Agency on request.
• Implement technical and organizational measures appropriate to the risk under Article 34, including pseudonymization and encryption where appropriate, and instruct anyone with access to personal data not to process it beyond the controller's authorization.
• Carry out a data protection impact assessment under Article 37 before processing likely to result in a high risk to a person's rights and freedoms, and consult the Agency in advance under Article 38 wherever the assessment shows a high risk the controller cannot mitigate.

Law on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent) · Read the law's page

• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.
• Process personal data about a criminal conviction or offence only under the supervision of a public authority or where a special law authorizes it with safeguards for the person's rights, and keep any register of criminal convictions exclusively under a public authority's control, under Article 12.
• Treat a child's consent to an information-society service offered directly to them as lawful only from age 16, and below that age obtain or verify the consent of a parent, adoptive parent, or guardian, making reasonable efforts to confirm it given available technology, under Article 10.

Law on the Protection of Personal Data, arts. 14-23, 25 (rights of data subjects) · Read the law's page

• Tell a person, at the latest when you collect their personal data or within a reasonable period if collected elsewhere, who you are, the purpose and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, under Articles 15 and 16.
• Answer a request for access, rectification, erasure, restriction, or portability under Articles 17 to 22, and notify any recipient the data were disclosed to of a rectification, erasure or restriction you make.
• Stop processing personal data for direct marketing purposes as soon as a person objects, under Article 23.

Law on the Protection of Personal Data, arts. 35-36, 86-87 (personal data breach notification) · Read the law's page

• Notify the Agency of a personal data breach without undue delay and, if possible, within 72 hours of becoming aware of the breach, giving the Agency the reasons for the delay where notice comes later.
• As a processor, notify the controller without undue delay after becoming aware of a personal data breach.
• Notify the affected person of a personal data breach without delay, in writing and in clear language, wherever the breach is likely to result in a high risk to that person's rights and freedoms, unless the data were rendered unintelligible, the high risk can no longer materialize, or notice would take disproportionate effort and a public notice reaches the person as effectively.
• Describe in the notification the nature of the breach, the data protection officer's or another contact point's details, the likely consequences and the measures taken or proposed, supplying the information in phases if it cannot all be given at once, and document every breach, its facts, effects and remedial action for the Agency to review.
• As a competent authority processing personal data for a criminal-law purpose, notify the Agency of a breach without delay and no later than 72 hours after becoming aware of it, and the affected person without delay under the same high-risk test, and pass the breach information to the data controller of another country without undue delay wherever the breached data were transmitted by or to it.

Law on the Protection of Personal Data, arts. 46-51, 91-95 (cross-border transfer) · Read the law's page

• Rely on a Council of Ministers adequacy decision, or an appropriate safeguard such as standard contractual clauses, binding business rules, or an approved code of conduct or certification, before transferring personal data outside Bosnia and Herzegovina, under Articles 46 to 49.
• Absent an adequacy decision or an appropriate safeguard, transfer personal data outside Bosnia and Herzegovina only on a narrow derogation such as the person's informed explicit consent, contractual necessity, or an essential public interest, and never repetitively or systematically, under Article 51.
• Do not recognize or carry out a foreign court judgment or administrative decision that would require you to transfer or disclose personal data, unless it rests on an international agreement such as a mutual-legal-assistance treaty between that country and Bosnia and Herzegovina, under Article 50.
• As a competent authority transferring personal data to another country or international organisation for a criminal-law purpose, apply the same adequacy-or-safeguards test and document your assessment, under Articles 91 to 95.

Law on the Protection of Personal Data, arts. 57a-57b (biometric data processing) · Read the law's page

• Obtain the person's explicit consent before processing a biometric identifier for the individual secure identification of a service user, and only where the processing is otherwise required by law or necessary to protect a person, property, classified information, or a trade secret, and the person's conflicting interests do not prevail, under Article 57a.
• Obtain an employee's explicit consent before processing their biometric data to record working time or to control entry to and exit from official premises, and offer it only where required by law or as an alternative to another recording or access method, under Article 57b.

Law on the Protection of Personal Data, arts. 96-115 (enforcement, supervision and penalties) · Read the law's page

• Expect a person in Bosnia and Herzegovina to have both an administrative complaint route to the Agency under Article 108 and a separate right to bring an action before the competent court under Article 110 for any infringement of this law, and to be able to claim compensation under Article 112 for damage your processing caused.
• Comply with an Agency order under Article 103, including a warning, a compliance order, a temporary or permanent restriction on processing, or a suspension of a transfer abroad, since defying one carries its own fine.
• Expect an administrative fine reaching BAM 40,000,000 or 4 percent of worldwide annual turnover, whichever is higher, for the most serious infringements, on top of a separate, smaller fine the Agency can impose on the responsible person or an employee individually.
• Expect a gross violation of this Act to expose the responsible person to criminal liability under Bosnia and Herzegovina's Criminal Codes, referred to by Article 115, rather than under this Act itself.