Makes justice decisions, in North Macedonia

Zakon za zastita na licnite podatoci (Law on Personal Data Protection), Official Gazette No. 42/2020 as amended by Official Gazette Nos. 294/2021 and 101/2025, fully applicable 24 August 2021, arts. 1-11, 15, 28-47, 81-83, 85-87, 94-96 (general provisions, principles and controller obligations) · Read the law's page

• Have one of the lawful grounds Article 10 lists, such as consent, necessity for a contract, a legal obligation, vital interests, a public-interest task or official authority, or legitimate interests, before processing personal data.
• Where processing rests on consent, be able to demonstrate that the data subject consented, present the request for consent clearly distinguishable from other matters, and let the data subject withdraw consent at any time as easily as it was given.
• Apply technical and organizational measures proportionate to the risk, keep them under review, and be able to demonstrate that your processing complies with the Law.
• Build data protection into your processing by design and by default, including pseudonymization and data minimization.
• Keep a record of the processing operations you are responsible for, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of natural persons, and designate a data protection officer where Article 41 requires one.
• Where a certification mechanism under Articles 46 and 47 is used, know that it is voluntary and does not by itself reduce responsibility for complying with the rest of this Law.
• Get the Agency's prior approval before any systematic and extensive processing of a citizen's national identification number, and otherwise process it only with the data subject's prior consent or another case a law states.
• Process personal data for direct marketing, including related profiling, only after the data subject has given explicit consent.
• Apply appropriate safeguards, such as pseudonymisation or data minimisation, when processing personal data for archiving in the public interest, or for scientific, historical or statistical purposes.
• Disclose personal data held in an official document only to fulfil a task in the public interest, reconciling public access to official documents with the right to data protection.

Zakon za zastita na licnite podatoci, art. 26 (automated individual decision-making, including profiling) · Read the law's page

• Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, under Article 26.
• Where a decision based solely on automated processing rests on a contract with the data subject or their explicit consent, implement suitable measures to safeguard their rights, freedoms and legitimate interests, at a minimum human intervention by the controller, the chance to express a personal view and the right to contest the decision, under Article 26, paragraph 3.
• Do not base such a decision on special categories of personal data unless Article 13, paragraph 2, point 1 or 7 applies and suitable safeguards are in place, under Article 26, paragraph 4.

Zakon za zastita na licnite podatoci, arts. 16-25 and 27 (rights of the data subject) · Read the law's page

• Facilitate the exercise of a data subject's rights under Articles 19 to 26.
• Answer a data subject's access request under Article 19 with confirmation of whether their data are processed and, if so, access to the data along with the listed information, including the purposes, categories, recipients, retention period and source.
• Rectify inaccurate personal data within 15 days of a request under Article 20.
• Erase personal data within 30 days of a request under Article 21 wherever one of its listed grounds applies.
• Stop processing a data subject's personal data for direct marketing once they object under Article 25.

CETS No. 225, signed by North Macedonia 8 May 2026

• This measure is proposed and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Provide transparency and accountability for AI systems.
• Provide redress for people harmed by AI systems.