Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer
Law on the Protection of Personal Data, arts. 46-51, 91-95 (cross-border transfer)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Rely on a Council of Ministers adequacy decision, or an appropriate safeguard such as standard contractual clauses, binding business rules, or an approved code of conduct or certification, before transferring personal data outside Bosnia and Herzegovina, under Articles 46 to 49.NIST Privacy FrameworkCT.PO-P2
- Absent an adequacy decision or an appropriate safeguard, transfer personal data outside Bosnia and Herzegovina only on a narrow derogation such as the person's informed explicit consent, contractual necessity, or an essential public interest, and never repetitively or systematically, under Article 51.NIST Privacy FrameworkCT.PO-P2
- Do not recognize or carry out a foreign court judgment or administrative decision that would require you to transfer or disclose personal data, unless it rests on an international agreement such as a mutual-legal-assistance treaty between that country and Bosnia and Herzegovina, under Article 50.NIST Privacy FrameworkCT.PO-P2
- As a competent authority transferring personal data to another country or international organisation for a criminal-law purpose, apply the same adequacy-or-safeguards test and document your assessment, under Articles 91 to 95.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.DE-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time
Logging duty
Article 51(7) requires a controller or processor that transfers on the compelling-legitimate-interests derogation to document its assessment and the safeguards in the Article 32 records. Articles 93(3) and 94(3) require a competent authority to document a transfer made on its own safeguards assessment or on a derogation, with the date and time, the receiving authority, the justification and the data transferred, and to make that documentation available to the Agency on request; Article 95(4) requires a transfer to a private recipient to be documented. Article 49(1)(j) requires binding business rules to provide for verification of compliance, including data protection auditing, with the results available to the Agency on request. That duty attaches only to a transfer made on binding business rules, and the Act states no interval for it.
- Kind
- Explicit
- As of
- Provision
- Article 51(7) (the assessment and safeguards behind a derogation transfer are documented in the Article 32 records) and Articles 93(3), 94(3) and 95(4) (a competent authority documents a transfer)
- Trigger
- personal_data_processing
What this law does
Article 46 lets a transfer to another country or international organisation take place only in compliance with this chapter, including an onward transfer. Article 47 lets a transfer proceed without further safeguards where the Council of Ministers, on the Agency's proposal, has decided that the destination ensures an adequate level of protection, a decision the Agency continuously reviews and reports on.
Absent an adequacy decision, Article 48 lets a transfer proceed on appropriate safeguards such as a legally binding instrument between public authorities, binding business rules under Article 49, an approved code of conduct or certification mechanism, or standard contractual clauses the Agency adopts, some subject to the Agency's prior approval.
Article 50 bars recognizing or carrying out a foreign court judgment or administrative decision that would require a transfer or disclosure of personal data unless it rests on an international agreement such as a mutual-legal-assistance treaty between the requesting country and Bosnia and Herzegovina.
Article 51 permits a transfer absent an adequacy decision or appropriate safeguards only on a listed derogation, such as the person's informed explicit consent, contractual necessity, an essential public interest, or a legal claim, and bars relying on the narrower residual derogation in Article 51(2) for a transfer that is repetitive or systematic.
Articles 91 to 95 restate the same adequacy, safeguards and derogation structure for a competent authority transferring personal data for the prevention, investigation, detection or prosecution of a criminal offence, adding that the transferring authority must weigh the seriousness of the offence and the destination's level of protection before authorizing an onward transfer, and that a transfer of data originally received from another country needs that country's prior authorisation except where an immediate and serious threat to public security makes obtaining it impossible in time.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .