Processes personal data, in Montenegro

Law on Personal Data Protection, arts. 20-21, 23, 43-46 (rights of the data subject; art. 11 deleted by Official Gazette 44/12) · Read the law's page

• Give a person from whom you collect personal data directly notice of your name and address, the purpose and legal basis of processing, the third party or user and the legal basis for disclosing to it, whether giving the data is mandatory or voluntary, and their rights of access and rectification, under Article 20, and give a similar notice no later than immediately before processing begins where the data were not collected directly, under Article 21.
• Erase personal data whose processing does not comply with the law on the person's request, under Articles 23 and 44.
• Answer a person's written request within 15 days, telling them whether personal data concerning them is processed and, if it is, the controller's identity, the content of the data, the purpose and legal basis, the source and the third party or user, under Article 43.
• Supplement or alter incomplete data and erase inaccurate or unlawfully processed data within 15 days of a person's written request, and notify the person and any third party of the change within eight days, under Article 44.
• Expect the rights in Articles 43 and 44 to be restricted only for defence, national or public security, the prevention, detection and prosecution of criminal offences, protection of economic or financial interests, or protection of the person or the rights and freedoms of others, to the extent necessary and in accordance with a special law, under Article 45, and bear the cost of an Article 43 or 44 proceeding yourself, under Article 46.

Law on Personal Data Protection, arts. 41-42 (transfer of personal data from Montenegro) · Read the law's page

• Obtain the prior consent of the Agency for Personal Data Protection and Free Access to Information before transferring personal data of a person in Montenegro to another country or to an international organisation, under Article 41, unless one of the Article 42 exceptions applies, including transfer to an EU or EEA Member State or a country on the EU adequacy list, the data subject's informed consent, or performance of a contract.
• Assess the adequacy of protection in the destination country against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law and security measures in force there, under Article 41, paragraph 2.

Law on Personal Data Protection, arts. 47-74 (agency, supervision and penal provisions) · Read the law's page

• Give the Agency's controllers access to your filing systems, files and electronic processing means on request, regardless of the level of data secrecy, under Articles 66 and 67, and comply with an Agency order to eliminate irregularities, stop unlawful processing, erase data collected without a legal basis, stop an unlawful transfer out of Montenegro or disclosure, or stop an unlawful entrusting of processing, under Article 71.
• Expect a person in Montenegro to be able to submit a request for protection of rights to the supervisory authority, which must decide within 60 days and may temporarily ban further processing meanwhile, under Article 47.
• Expect a person in Montenegro to have a civil damages claim against you under Article 48 for a breach of their rights under this law, separate from an administrative complaint to the Agency.
• Expect a fine of EUR 500 to EUR 20,000 for a legal person, EUR 150 to EUR 2,000 for a responsible person in a legal person, a state body or a local government body, and for an individual, and EUR 150 to EUR 6,000 for an entrepreneur, for the violations listed in Article 74.

Law on Personal Data Protection, arts. 9(7)-(9), 12-14 (special categories of data) · Read the law's page

• Do not process special categories of data, meaning data on racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, health or sex life, unless one of the exceptions in Article 13 applies, starting with the person's explicit consent.
• Process a child's personal data in a manner that is in the best interest of the child, under Article 12.
• Distinctively designate and protect special categories of data against unauthorised access, under Article 13.
• Do not process personal data relating to criminal offences, imposed criminal or misdemeanor penalties or security measures except by, or under the supervision of, the competent state authority, and only with the safeguards the law requires, under Article 14.

Official Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24, as amended, arts. 1-10, 16-30 and 33-40 (general processing, security and registration) · Read the law's page

• Establish a lawful basis, such as the data subject's prior consent or one of the grounds listed in Article 10, before processing personal data of a person in Montenegro.
• Enter into a written contract before entrusting personal data processing to a processor, and use only a processor that meets the conditions for implementing technical, personnel and organizational protection measures, under Article 16.
• Implement technical, personnel and organizational safeguards appropriate to the nature of the data processed to protect it against loss, destruction, unauthorized access, alteration, disclosure and abuse, under Article 24, and keep confidential any personal data your staff become privy to in the course of their work, under Article 25.
• Keep records of every personal data filing system you establish, covering the matters Article 26 lists, send the supervisory authority a notification before establishing an automatic filing system or significantly changing its processing, under Article 27, and obtain its consent before automatic processing that poses a special risk to the rights and freedoms of persons, under Article 28.
• Where you run video surveillance of business or official premises, display a public notice of it, avoid recording residential interiors or apartment entrances, and keep the personal data in the video surveillance record for no longer than six months, under Articles 35 to 39; keep entry and exit records for no longer than one year, under Article 34.

Law on Information Security, Arts. 1 to 3, 7 to 15 and 18(1) to (3) · Read the law's page

• This binds you if you access or process data, or use and manage a network and information system, in Montenegro, whether you are a business, another legal entity or a natural person, and regardless of your sector or size (Article 2).
• Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).
• Physically secure the premises, spaces and devices that house your network and information system (Article 14).
• Protect the confidentiality, integrity and availability of the data you process, store or transmit through the planning, design, construction, use, maintenance and decommissioning of that system (Article 15).
• Designate an employee to monitor your compliance with these measures (Article 18(3)).

Law on Information Security, Arts. 28 to 37 · Read the law's page

• Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).
• Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).
• For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).
• For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).
• This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).

Law on Personal Data Protection, Official Gazette of Montenegro No. 133/2026, arts. 1-10 and 105-106 (scope, principles, lawful basis, special categories, repeal of the 2008 Law and application) · Read the law's page

• Have one of the lawful bases Article 7 lists, such as the data subject's consent, performance of a contract or a legal obligation, before processing the personal data of a person in Montenegro, and be able to show that you comply with the principles in Article 6.
• Where you rely on consent, be able to prove it, ask for it in clear and plain language that is distinct from other matters, and let the person withdraw it as easily as they gave it, as Article 8 requires.
• Do not process the personal data of a child under 16 for an information society service on the child's own consent; obtain the consent or authorization of the holder of parental responsibility, as Article 9 requires.
• Do not process special categories of personal data, including biometric data used to uniquely identify a person, unless one of the conditions in Article 10 applies, such as the data subject's explicit consent.