Handles health records, in Montenegro

Law on Personal Data Protection, arts. 9(7)-(9), 12-14 (special categories of data) · Read the law's page

• Do not process special categories of data, meaning data on racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, health or sex life, unless one of the exceptions in Article 13 applies, starting with the person's explicit consent.
• Process a child's personal data in a manner that is in the best interest of the child, under Article 12.
• Distinctively designate and protect special categories of data against unauthorised access, under Article 13.
• Do not process personal data relating to criminal offences, imposed criminal or misdemeanor penalties or security measures except by, or under the supervision of, the competent state authority, and only with the safeguards the law requires, under Article 14.

Law on Information Security, Arts. 28 to 37 · Read the law's page

• Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).
• Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).
• For an incident the Agency rates medium, submit a first report within 72 hours of your initial notification, a further report without delay on any new development, continuing reports every 72 hours while the incident lasts, and a final report within 30 days of resolving it (Article 33).
• For an incident the Agency rates high, follow the same reporting sequence on a tighter clock: continuing reports every 24 hours while the incident lasts (Article 34).
• This binds you on the same broad terms as this jurisdiction's general security-measures row: any business, other legal entity or natural person that accesses or processes data through a network and information system in Montenegro, regardless of sector, size, or essential or important entity designation (Article 2).

Law on Information Security, Arts. 4, 16, 18(4) to (6), and 19 to 27 · Read the law's page

• If designated, adopt a cyber-security risk and security analysis, an incident-handling policy, a business-continuity and cyber-crisis plan, a supply-chain security act and system-governance acts, apply cryptographic protection where your work requires it, and assess the effectiveness of these measures (Article 16).
• If designated an essential entity, obtain a certificate of compliance with the Montenegrin standard MEST ISO/IEC 27001 from an accredited body within 30 months of 5 December 2024, and request a periodic re-verification from that body afterward (Article 18(4) to (6) and Article 73).
• Report any change to your registration details to the competent ministry within 14 days of the change (Article 26).
• This reaches you only where the Government of Montenegro has designated your organisation an essential or important entity on a sector list adopted under Articles 19 to 22. The digital-infrastructure essential-entity sector (an internet exchange point, a DNS or top-level-domain registry, a cloud computing, data centre, content delivery network or qualified trust service provider) and the online-marketplace important-entity sector are the digital categories closest to a software or platform business; the ICT-service-management essential-entity sector and the wider non-digital sectors (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, public administration and space among essential entities; postal and courier services, waste management, chemicals, food, manufacturing and research among important entities) are reached by declaring that you are an essential or important entity.