Publishes adult content, in Montenegro

Law on Audiovisual Media Services, Arts. 59 and 130, Official Gazette of Montenegro No. 54/2024 · Read the law's page

• Applies to providers of on-demand audiovisual media services (Article 59) and video-sharing platform providers (Article 130).
• Make content that could impair a minor's physical, health-related, moral, mental, intellectual, emotional or social development available only in the way least likely for minors to ordinarily encounter it, using measures such as content categorisation and age-verification tools.
• Make content that could seriously impair that development, including pornography or gratuitous depiction of violence, available only behind the highest level of technical protection, such as a special code or identity verification.
• Video-sharing platforms: establish and apply an age-verification system for platform users in relation to content that could endanger a minor's psychological, physical or moral development.
• Do not process a minor's personal data collected through these measures for commercial purposes such as direct marketing, profiling or targeted behavioural advertising.

Law on Information Security, Arts. 1 to 3, 7 to 15 and 18(1) to (3) · Read the law's page

• This binds you if you access or process data, or use and manage a network and information system, in Montenegro, whether you are a business, another legal entity or a natural person, and regardless of your sector or size (Article 2).
• Adopt rules for handling data, log who has accessed it, and oversee the security of that data (Article 12).
• Physically secure the premises, spaces and devices that house your network and information system (Article 14).
• Protect the confidentiality, integrity and availability of the data you process, store or transmit through the planning, design, construction, use, maintenance and decommissioning of that system (Article 15).
• Designate an employee to monitor your compliance with these measures (Article 18(3)).

Law on Information Security, Arts. 28 to 37 · Read the law's page

• Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).
• Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).
• For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).
• For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).
• This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).