Bosnia and HerzegovinaLaw on the Protection of Personal Data of Bosnia and Herzegovina
Law on the Protection of Personal Data Official Gazette of Bosnia and Herzegovina No. 12/25, applicable , arts. 1-9, 13, 26-34, 37-45, 52-65 (excluding 57a-57b), 75-85, 88-90 (general provisions, lawful basis, controller and processor duties, security, DPIA, DPO)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Consent, Security, DPIA, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis under Article 8 before processing personal data of a person in Bosnia and Herzegovina, and appoint a Data Protection Officer under Articles 39 to 41 wherever the processing meets the threshold the Act sets, such as processing carried out by a public authority or large-scale monitoring or special-category processing.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P3
- Keep a written record of processing activities under Article 32, covering the purposes, the categories of data subjects and data, the recipients, any transfer abroad, and the envisaged erasure periods, and make it available to the Agency on request.NIST Privacy FrameworkID.IM-P4
- Implement technical and organizational measures appropriate to the risk under Article 34, including pseudonymization and encryption where appropriate, and instruct anyone with access to personal data not to process it beyond the controller's authorization.NIST Privacy FrameworkPR.DS-P1NIST Privacy FrameworkPR.AC-P4
- Carry out a data protection impact assessment under Article 37 before processing likely to result in a high risk to a person's rights and freedoms, and consult the Agency in advance under Article 38 wherever the assessment shows a high risk the controller cannot mitigate.NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- PR.DS-P1Data-at-rest are protected.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which law supplies the legal basis that Article 8, paragraph 2 requires for processing under Article 8, paragraph 1, points (c) and (e), given that it is to be "laid down by the laws of the institutions of BiH, and canton entities in accordance with their respective competences"?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Log retention
The 12-month floor in Article 57(6) applies only to the use records of a video surveillance system in publicly accessible facilities. Articles 32, 80 and 81 set no period for keeping their records, and Article 32(1)(f) concerns erasure of the personal data, not of the record.
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 12
Logging duty
Article 32(1) and (2) require every controller and processor to keep a written record of its processing activities (Article 32(3)), and Article 32(4) requires them to make it available to the Agency on request (the English text says "logs"). Article 32(5) lifts the duty for an operator with fewer than 250 persons unless the processing is high risk, not occasional, or covers special-category or criminal-conviction data. Article 57(6) adds a record of the use of the video surveillance system of large publicly accessible facilities, kept for at least 12 months, and Article 81 requires a competent authority running an automated system to record collection, alteration, consultation, disclosure, combination and erasure; Article 80 is the competent authority's own record of processing. Article 9(1) and Article 7(2) also require a controller to be able to demonstrate consent and compliance, without naming a record. The Article 32 record holds purposes, categories and recipients, which are not values of the log-contents list, so the contents listed are those of Articles 57(6) and 81.
- Kind
- Explicit
- As of
- Provision
- Article 32 (record of processing activities), with Article 57(6) (use records of a video surveillance system) and Articles 80 and 81 (a competent authority's records and automatic log)
- Trigger
- personal_data_processing
What this law does
The Law on the Protection of Personal Data transposes Regulation (EU) 2016/679 for ordinary processing under Part One and Directive (EU) 2016/680 for processing by a competent authority for a criminal-law purpose under Part Two, and Article 6 gives it effect across Bosnia and Herzegovina rather than in one entity alone.
Article 8 sets the lawful bases for processing, running from the person's consent through contractual necessity, a legal obligation, vital interests, a public task or a legitimate interest that does not override the person's own rights, and Article 8(2) leaves the legal basis for a public-interest or official-authority task to the laws of the institutions of Bosnia and Herzegovina and, within their own competences, the entities and cantons.
Article 9 sets the conditions for a valid consent, including the controller's burden to demonstrate it and the person's right to withdraw it as easily as it was given, and Article 13 lets a controller that no longer needs to identify a data subject decline to acquire, keep or process additional information solely to comply with this Act.
Articles 26 to 31 allocate controller, joint-controller, processor and representative duties, and Article 27 requires personal data protection by design and by default. Article 32 requires a written record of processing activities naming the purposes, the categories of data and data subjects, the recipients, any transfer abroad and the envisaged erasure periods, with a limited exemption for an organization with fewer than 250 employees.
Article 34 requires technical and organizational security measures appropriate to the risk, including pseudonymization and encryption where appropriate. Article 37 requires a data protection impact assessment before processing likely to result in a high risk, and Article 38 requires prior consultation with the Agency where the assessment shows a risk the controller cannot mitigate.
Articles 39 to 41 require a Data Protection Officer for a public authority, for large-scale systematic monitoring, or for large-scale processing of special categories or criminal-conviction data. Articles 42 to 45 let the Agency approve a code of conduct or a certification mechanism as evidence of compliance.
Articles 52 to 59 carry sector rules for freedom of expression and information, public access to official documents, a unique identification number, the employment context, archiving and research, video surveillance, churches and religious communities, and professional secrecy.
Articles 60 to 65, 75 to 85 and 88 to 90 restate the same lawful-basis, controller-allocation, security, impact-assessment, prior-consultation and Data Protection Officer duties for a competent authority processing personal data for the prevention, investigation, detection or prosecution of a criminal offence.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .