Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penalties
Law on the Protection of Personal Data, arts. 96-115 (enforcement, supervision and penalties)
In force since .
An enforcement supervision rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Governance, Reporting
- Audit expectation
- periodic
- Who audits it
- Regulator
What it requires
- Expect a person in Bosnia and Herzegovina to have both an administrative complaint route to the Agency under Article 108 and a separate right to bring an action before the competent court under Article 110 for any infringement of this law, and to be able to claim compensation under Article 112 for damage your processing caused.
- Comply with an Agency order under Article 103, including a warning, a compliance order, a temporary or permanent restriction on processing, or a suspension of a transfer abroad, since defying one carries its own fine.
- Expect an administrative fine reaching BAM 40,000,000 or 4 percent of worldwide annual turnover, whichever is higher, for the most serious infringements, on top of a separate, smaller fine the Agency can impose on the responsible person or an employee individually.
- Expect a gross violation of this Act to expose the responsible person to criminal liability under Bosnia and Herzegovina's Criminal Codes, referred to by Article 115, rather than under this Act itself.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 115 of the Act (Penalties) refers a gross violation of the Act to Bosnia and Herzegovina's Criminal Codes for criminal liability, rather than stating a maximum in this Act itself: 'The Criminal Codes provide for penalties for the criminal offence of unlawful processing of personal data, in the event of a gross violation of the provisions of this Act.' A secondary source (not machine-verified against the current official text) describes the state-level Krivicni zakon BiH as criminalizing unauthorized collection, processing or use of personal data by an official or responsible person of a Bosnia and Herzegovina institution, punishable by a fine or imprisonment of up to six months, with a related unauthorized-computer-database offense punishable by up to five years where committed for gain or to cause harm. Bosnia and Herzegovina also has separate Federation of Bosnia and Herzegovina, Republika Srpska and Brcko District criminal codes, each of which is an entity or district of Bosnia and Herzegovina rather than a foreign jurisdiction, that may carry parallel provisions reaching private-sector controllers; none of those texts, nor the current state-level code, were read in full, so no maximum penalty is confirmed against primary text.
Penalty structure
Article 113(5) sets the higher administrative-fine tier, BAM 20,000 to BAM 40,000,000 or, in the case of an undertaking, up to 4 percent of total worldwide annual turnover for the preceding financial year, whichever is higher, for processing contrary to Articles 7, 8, 9 and 11 (principles, lawful basis, special categories) and for violations of data subject rights. Article 113(6) sets the same BAM 20,000 to BAM 40,000,000 / 4 percent tier for failure to comply with an Agency order or refusal of access under Article 103. A separate lower tier under Article 113(4), BAM 10,000 to BAM 20,000,000 or up to 2 percent of turnover, whichever is higher, applies to the data controller, processor, certification body or code-of-conduct monitoring body for processing contrary to Articles 10, 13, 27 to 41, 44 and 45 (records, security of processing, DPO, DPIA and certification duties). Article 113(7) and (8) additionally fine the natural 'responsible person' BAM 5,000 to BAM 70,000, and an employee BAM 500 to BAM 5,000, for the same violations. Article 113(10) bars fines against the public body itself; only the responsible or employed person within it is fined.
- Rule
- Higher of
- As of
- Minimum
- 20,000
- Currency
- BAM
- Fixed cap
- 40,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zastitu licnih podataka u Bosni i Hercegovini, AZLP)
Settledness
- As of
- Open questions
- Which criminal offence in the Criminal Codes does Article 115 mean by "unlawful processing of personal data", and what makes a violation of the Act a "gross violation"?
- Does "The Criminal Codes" in Article 115 reach the entity and Brcko District criminal codes as well as the state-level Criminal Code, so that a private-sector controller can be prosecuted under any of them?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 96 to 115 set up the Agency and give it powers: Article 103(1) lets it carry out inspections and data protection audits, order a controller or processor to supply information, and gain access to all personal data and information and to the premises, and Article 107 lays out regular, extraordinary and auditing inspections. They impose no duty on a controller or processor to make or keep a record. The only record named is the Agency's own: the inspector's record of the established facts, signed with the controller or processor (Article 107(11)), and the inspector's records of inspections (Article 107(15)).
- Kind
- None
- As of
What this law does
Article 96 establishes the Agency as an independent supervisory body seated in Sarajevo, Article 97 secures its independence, and Articles 98 to 100 govern the Agency's management, the appointment and dismissal of its Director and Deputy Director, and the incompatibility and professional-secrecy duties of its staff.
Article 101 makes the Agency responsible for the tasks and powers this Act confers and for supervising controllers and processors, other than a court exercising a judicial function, and Article 102 lists the Agency's tasks, including advising public authorities, raising public and controller awareness, deciding a person's complaint within 90 days, and approving codes of conduct, certification mechanisms and binding business rules.
Article 103 gives the Agency investigative powers, including ordering information, inspecting premises and accessing data, corrective powers, including a warning, an order to comply with a data subject's request, an order to bring processing into compliance, a temporary or permanent restriction or prohibition on processing, an order to notify a breach, and a suspension of a transfer abroad, and authorisation and advisory powers, and Article 103(4) makes an Agency decision final in administrative proceedings, subject only to an administrative dispute before the Court of Bosnia and Herzegovina.
Article 105 lets a person confidentially report a violation of this Act, and Article 107 lets the Agency carry out inspections.
Article 108 gives a person the right to complain to the Agency without prejudice to another remedy, and Article 109 gives a person, controller or processor the right to bring an administrative dispute against an Agency decision before the Court of Bosnia and Herzegovina within 60 days, or, where the Agency misses its 90-day deadline or fails to report progress on a complaint, on that same ground.
Article 110 gives a person a standalone right to judicial redress against a controller or processor, alongside the administrative complaint, and Article 111 lets a person authorize a non-profit body active in personal-data protection to exercise these rights, including a claim for compensation, on their behalf.
Article 112 entitles anyone who suffers material or non-material damage from an infringement of this Act to compensation from the controller or, in the narrower cases the article lists, the processor, with joint and several liability where more than one is responsible.
Articles 113 and 114 fix the fines: BAM 10,000 to BAM 20,000,000, or up to 2 percent of worldwide turnover, whichever is higher, for the lighter Article 113(4) violations such as a code-of-conduct or certification breach; BAM 20,000 to BAM 40,000,000, or up to 4 percent of worldwide turnover, whichever is higher, for processing contrary to the principles, lawful-basis or special-category articles, for violating a data subject's rights, for an unlawful transfer abroad, or for defying an Agency order; and a separate fine of BAM 5,000 to BAM 70,000 on the responsible natural person and BAM 500 to BAM 5,000 on an employee for the same violations, with no fine reaching the public body itself.
Article 115 refers a gross violation of this Act to Bosnia and Herzegovina's Criminal Codes for criminal liability rather than stating a penalty in this Act itself, and because the state, the Federation of Bosnia and Herzegovina, Republika Srpska and Brcko District each keep their own criminal code, more than one code can carry the offence depending on which authority is responsible.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .