MontenegroLaw on Personal Data Protection
Official Gazette of Montenegro Nos. 79/08 70/09, 44/12, 22/17 and 77/24, as amended, arts. 1-10, 16-30 and 33-40 (general processing, security and registration)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Contract terms, Security, Governance
- Audit expectation
- none
What it requires
- Establish a lawful basis, such as the data subject's prior consent or one of the grounds listed in Article 10, before processing personal data of a person in Montenegro.
- Enter into a written contract before entrusting personal data processing to a processor, and use only a processor that meets the conditions for implementing technical, personnel and organizational protection measures, under Article 16.
- Implement technical, personnel and organizational safeguards appropriate to the nature of the data processed to protect it against loss, destruction, unauthorized access, alteration, disclosure and abuse, under Article 24, and keep confidential any personal data your staff become privy to in the course of their work, under Article 25.
- Keep records of every personal data filing system you establish, covering the matters Article 26 lists, send the supervisory authority a notification before establishing an automatic filing system or significantly changing its processing, under Article 27, and obtain its consent before automatic processing that poses a special risk to the rights and freedoms of persons, under Article 28.
- Where you run video surveillance of business or official premises, display a public notice of it, avoid recording residential interiors or apartment entrances, and keep the personal data in the video surveillance record for no longer than six months, under Articles 35 to 39; keep entry and exit records for no longer than one year, under Article 34.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a user's own phone or computer count as the 'oprema za obradu ličnih podataka' (equipment for processing personal data) located in Montenegro under Article 5, paragraph 2, so that a controller established outside Montenegro that collects data through that device must designate a representative in Montenegro?
What it makes you log
What the log must hold
Event time, Actor identity, Access record
Log retention
Article 19 fixes ten years for the record of third parties and users, after which its data are deleted.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 10
- Minimum value
- 10
Logging duty
Article 24(3) requires that, where personal data are processed electronically, the information system automatically records the users of the data, the data processed, the legal basis for use, the case number, and the log-in and log-out times; the controller also keeps a record of users in line with its own act. Article 19 requires a record of third parties and users, the data given for use, the purpose, the legal basis and the time of use. Article 26 requires a record of each personal data filing system, Article 34 allows an entry-and-exit record for business premises and Article 37 requires a record of video surveillance. The Law does not say who may demand the records or how they are audited in the articles this row cites, so audit is none and access is empty; the Agency's powers of supervision (Articles 66 and 67) are outside the cited articles. The Article 26 record is filed in the Agency's register under Articles 27 and 29, and its public availability under Article 30 is the register's, not a log's, so it is left out of the access coding. Article 6(6) allows consent to be given in writing or orally on the record, which is a form for giving consent and not a duty to keep a record of it. Article 5 turns on where the processing takes place, or on where processing equipment sits for a foreign controller, which no hook value names, so no hook is recorded. The record retention coded is Article 19's ten years; the personal data in an Article 34 record are kept at most one year and those in an Article 37 video record at most six months.
- Kind
- Explicit
- As of
- Provision
- Article 24(3) (automatic recording of users in the information system), Article 19 (record of third parties and users), with the records of Articles 26, 34 and 37
- Trigger
- personal_data_processing
What this law does
The Law on Personal Data Protection published in Official Gazette of Montenegro No. 79/2008 is in force. A new Law on Personal Data Protection, published in Official Gazette of Montenegro No. 133/2026, enters into force on and applies from .
Article 4a lets a state authority, public administration body, local self-government or local administration authority, commercial company or other legal person, entrepreneur or natural person be the controller of a personal data filing system.
Article 5 binds controllers of personal data filing systems that process personal data on the territory of Montenegro, or outside it where Montenegrin rules apply under international law, and a controller established or domiciled outside Montenegro if the equipment used for processing is in Montenegro, unless it is used only to transit data through Montenegro.
Article 5 also requires a controller in that situation to designate a representative or agent, seated or domiciled in Montenegro, who is responsible for applying the law. Article 7 applies the law to processing of personal data carried out wholly or partly by automatic means, or otherwise where the data form or will form part of a personal data filing system.
Article 10 permits processing with the data subject's prior consent, which may be withdrawn at any time, or without it where processing is necessary for one of five listed grounds, running from a legal obligation of the controller to an interest of the controller or a third party that has a basis in law, unless that interest has to be limited to protect the person's rights and freedoms.
A controller may entrust specific processing activities to a processor only by a written contract under Article 16, which regulates their mutual rights and obligations, in particular the processor's duty to follow the controller's instructions, and only to a processor that meets the conditions for implementing technical, personnel and organizational protection measures.
Article 24 requires the controller and the processor to implement technical, personnel and organizational safeguards appropriate to the nature of the data processed, to protect against loss, destruction, unauthorized access, alteration, disclosure and abuse.
Article 25 requires officials and other persons who process personal data in a state body, local government, company or other legal person to act only on the instructions of the head of the body or the responsible person, and to keep secret the personal data they learn in their work. Article 26 requires the controller to keep records of the personal data filing systems it establishes.
Article 27 requires the controller, before establishing an automatic filing system, to send the supervisory authority a notification containing the data listed in Article 26, paragraph 2, and to do the same on a significant change in processing. After establishing an automatic filing system, the controller must designate a person responsible for personal data protection, unless it has fewer than 10 officials who process personal data.
Article 28 requires the controller to obtain the supervisory authority's consent before automatic processing that poses a special risk to the rights and freedoms of persons, in particular where special categories of data or data used to assess personality, ability or behavior are to be processed, public-area video surveillance is to be introduced, or biometric data are to be processed, and does not apply where the processing rests on a law, the person's consent or a contract with the person.
Article 29 provides that the supervisory authority keeps the Register of the records of personal data filing systems. Article 33 lets a public-sector body, company, other legal person or entrepreneur require a person entering business or official premises to state the reason for entry, give personal data and, if needed, show an identification document.
Article 34 provides that the personal data in a record of entries and exits are kept for no longer than one year from collection and then deleted, unless a law provides otherwise. Article 35, paragraph 1 lets a public-sector body, company, other legal person or entrepreneur use video surveillance of access to official or business premises for the safety of persons and property, control of entry and exit, or, because of the nature of the work, a possible risk to employees.
Article 35 requires that video surveillance not show recordings of the interior of residential buildings unconnected with the entrance to official and business premises, or of apartment entrances. Article 36, paragraph 2 does not allow video surveillance in official and business premises outside the workplace, in particular in cloakrooms, elevators, sanitary rooms and the space intended for clients and visitors.
Article 37 provides that the personal data in a video surveillance record are kept for no longer than six months from creation. Article 38 allows video surveillance of the entrances and common areas of a residential building with the written consent of the owners' assembly, given by members holding more than 70% of the ownership, and bars video surveillance of apartment entrances.
Article 39 requires a body, company or entrepreneur using video surveillance to display a public notice of it in a visible place so that persons learn of it before it starts, and no later than when it starts. The Law as first enacted came into force on and has applied since . The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .