Processes personal data, in North Macedonia

Zakon za zastita na licnite podatoci (Law on Personal Data Protection), Official Gazette No. 42/2020 as amended by Official Gazette Nos. 294/2021 and 101/2025, fully applicable 24 August 2021, arts. 1-11, 15, 28-47, 81-83, 85-87, 94-96 (general provisions, principles and controller obligations) · Read the law's page

• Have one of the lawful grounds Article 10 lists, such as consent, necessity for a contract, a legal obligation, vital interests, a public-interest task or official authority, or legitimate interests, before processing personal data.
• Where processing rests on consent, be able to demonstrate that the data subject consented, present the request for consent clearly distinguishable from other matters, and let the data subject withdraw consent at any time as easily as it was given.
• Apply technical and organizational measures proportionate to the risk, keep them under review, and be able to demonstrate that your processing complies with the Law.
• Build data protection into your processing by design and by default, including pseudonymization and data minimization.
• Keep a record of the processing operations you are responsible for, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of natural persons, and designate a data protection officer where Article 41 requires one.
• Where a certification mechanism under Articles 46 and 47 is used, know that it is voluntary and does not by itself reduce responsibility for complying with the rest of this Law.
• Get the Agency's prior approval before any systematic and extensive processing of a citizen's national identification number, and otherwise process it only with the data subject's prior consent or another case a law states.
• Process personal data for direct marketing, including related profiling, only after the data subject has given explicit consent.
• Apply appropriate safeguards, such as pseudonymisation or data minimisation, when processing personal data for archiving in the public interest, or for scientific, historical or statistical purposes.
• Disclose personal data held in an official document only to fulfil a task in the public interest, reconciling public access to official documents with the right to data protection.

Zakon za zastita na licnite podatoci, arts. 12-14, 84 (special categories, a child's consent and biometric, health and genetic data) · Read the law's page

• The processing of a child's personal data for an information society service offered directly to the child is lawful where the child is at least 14 years old, or, if younger, only where the child's legal representative has given or authorized the consent; make a reasonable effort to verify that consent, taking available technology into account.
• Get the Agency's prior approval before processing health data, genetic data or biometric data of a person in North Macedonia, including where the processing rests on the data subject's own explicit consent, unless the processing is determined by a law that itself provides safeguards or the genetic data is processed by an expert for preventive medicine, diagnostics or treatment.
• Do not process a special category of personal data unless one of Article 13's exceptions applies, such as the data subject's explicit consent, a necessity ground tied to employment or social security law, vital interests, or an important public interest carried out with suitable safeguards.
• Process personal data relating to criminal convictions and offences only under the control of an official authority, or under a law that provides appropriate safeguards for the rights and freedoms of data subjects.

Zakon za zastita na licnite podatoci, arts. 16-25 and 27 (rights of the data subject) · Read the law's page

• Facilitate the exercise of a data subject's rights under Articles 19 to 26.
• Answer a data subject's access request under Article 19 with confirmation of whether their data are processed and, if so, access to the data along with the listed information, including the purposes, categories, recipients, retention period and source.
• Rectify inaccurate personal data within 15 days of a request under Article 20.
• Erase personal data within 30 days of a request under Article 21 wherever one of its listed grounds applies.
• Stop processing a data subject's personal data for direct marketing once they object under Article 25.

Zakon za zastita na licnite podatoci, arts. 37-38 (personal data breach notification) · Read the law's page

• Notify the Agency of a personal data breach immediately and no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and give reasons for any delay beyond 72 hours.
• As a processor, notify the controller immediately after becoming aware of a personal data breach.
• Document every personal data breach, including its facts, consequences and the action taken, so the Agency can verify compliance.
• Notify the affected data subject immediately of a personal data breach likely to cause a high risk to their rights and freedoms, unless an exception such as prior encryption, later mitigation, or disproportionate effort applies.

Zakon za zastita na licnite podatoci, arts. 48-56 (transfer of personal data), as amended by Official Gazette 101/2025 · Read the law's page

• Transfer personal data to a third country or an international organization only where the Agency has assessed that it ensures an adequate level of protection, or where you have provided an appropriate safeguard such as binding corporate rules or standard data protection clauses and data subjects have available judicial protection.
• Know that the chapter's transfer conditions do not reach a transfer from North Macedonia to a member state of the European Union, the European Economic Area or NATO, though the controller or processor must still notify the Agency of it.
• Absent an adequacy decision or appropriate safeguards, transfer personal data to a third country only on a listed ground such as the data subject's explicit consent after being informed of the risks, or necessity for performing a contract.

Zakon za zastita na licnite podatoci, arts. 57-80, 97-116 (the Agency, supervision and misdemeanour provisions) · Read the law's page

• Cooperate with the Personal Data Protection Agency's supervisors during a regular, irregular or control supervision, including granting access to premises, documents and equipment relevant to personal data processing.
• Compensate any person who suffers material or non-material damage from your infringement of this Law, as a controller, and as a processor where you did not comply with the Law's processor-specific obligations or acted outside or contrary to the controller's lawful instructions.
• Expect a misdemeanour fine of up to 2% of the controller or processor's total annual turnover for violating a Category I obligation Article 110 lists, or up to 4% for a Category II obligation Article 111 lists, alongside small fixed fines against the responsible individual.
• Expect a misdemeanour fine of 1,000 to 10,000 euros in denar equivalent against a controller that performs video surveillance, or processes personal data through one, contrary to Articles 89 to 92.
• Expect the Agency to bring a misdemeanour procedure only within two years of the day the violation was committed, since the statute of limitations runs from that day.

Zakon za zastita na licnite podatoci, arts. 89-93 (video surveillance, notice, retention and destruction) · Read the law's page

• Publish a clear, visible notice that video surveillance is in place before operating it, naming the controller and explaining how to learn the place and storage period of the recordings, and notify employees of video surveillance on official or business premises.
• Limit video surveillance to the area sufficient for the goal it was installed for, and never install it in changing rooms, dressing rooms, toilets or similar rooms.
• Store video surveillance recordings for no longer than 30 days unless another law sets a longer period with its own safeguards, and remove, at your own expense, any camera installed contrary to this Law.
• Obtain the written consent of at least 70% of the owners or tenants of a single-unit or multi-unit residential building before introducing video surveillance there, and never transmit its recordings over cable television, the internet or another electronic means, or record the entrances to other individual apartments.
• Analyse the goal of a video surveillance system before installing it, and reassess it every two years, covering the continuing need for it, its goals, and feasible technical alternatives.