Processes biometric data, in Montenegro

Law on Personal Data Protection, arts. 31-32 (biometric measures) · Read the law's page

• Perform biometric measures, meaning the establishment and comparison of personal traits by processing biometric data to establish or prove an individual's identity, only in accordance with this law, under Article 31.
• Apply a biometric measure in the public sector only in connection with entry into business or official premises and the presence of employees at work, only where a law prescribes it, and prescribe it only where it is necessary for the safety of persons or property or to protect secret data or business secrets and that cannot be achieved another way, or to carry out international treaty obligations and establish the identity of persons crossing the state border, under Article 32.when it serves a public body

Official Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24, as amended, arts. 1-10, 16-30 and 33-40 (general processing, security and registration) · Read the law's page

• Establish a lawful basis, such as the data subject's prior consent or one of the grounds listed in Article 10, before processing personal data of a person in Montenegro.
• Enter into a written contract before entrusting personal data processing to a processor, and use only a processor that meets the conditions for implementing technical, personnel and organizational protection measures, under Article 16.
• Implement technical, personnel and organizational safeguards appropriate to the nature of the data processed to protect it against loss, destruction, unauthorized access, alteration, disclosure and abuse, under Article 24, and keep confidential any personal data your staff become privy to in the course of their work, under Article 25.
• Keep records of every personal data filing system you establish, covering the matters Article 26 lists, send the supervisory authority a notification before establishing an automatic filing system or significantly changing its processing, under Article 27, and obtain its consent before automatic processing that poses a special risk to the rights and freedoms of persons, under Article 28.
• Where you run video surveillance of business or official premises, display a public notice of it, avoid recording residential interiors or apartment entrances, and keep the personal data in the video surveillance record for no longer than six months, under Articles 35 to 39; keep entry and exit records for no longer than one year, under Article 34.

Law on Information Security, Arts. 1 to 3, 7 to 15 and 18(1) to (3) · Read the law's page

• This binds you if you access or process data, or use and manage a network and information system, in Montenegro, whether you are a business, another legal entity or a natural person, and regardless of your sector or size (Article 2).
• Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).
• Physically secure the premises, spaces and devices that house your network and information system (Article 14).
• Protect the confidentiality, integrity and availability of the data you process, store or transmit through the planning, design, construction, use, maintenance and decommissioning of that system (Article 15).
• Designate an employee to monitor your compliance with these measures (Article 18(3)).

Law on Information Security, Arts. 28 to 37 · Read the law's page

• Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).
• Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).
• For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).
• For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).
• This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).

Law on Personal Data Protection, Official Gazette of Montenegro No. 133/2026, arts. 1-10 and 105-106 (scope, principles, lawful basis, special categories, repeal of the 2008 Law and application) · Read the law's page

• Have one of the lawful bases Article 7 lists, such as the data subject's consent, performance of a contract or a legal obligation, before processing the personal data of a person in Montenegro, and be able to show that you comply with the principles in Article 6.
• Where you rely on consent, be able to prove it, ask for it in clear and plain language that is distinct from other matters, and let the person withdraw it as easily as they gave it, as Article 8 requires.
• Do not process the personal data of a child under 16 for an information society service on the child's own consent; obtain the consent or authorization of the holder of parental responsibility, as Article 9 requires.
• Do not process special categories of personal data, including biometric data used to uniquely identify a person, unless one of the conditions in Article 10 applies, such as the data subject's explicit consent.