MontenegroLaw on Personal Data Protection, transfer of personal data from Montenegro
Law on Personal Data Protection, arts. 41-42 (transfer of personal data from Montenegro)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Obtain the prior consent of the Agency for Personal Data Protection and Free Access to Information before transferring personal data of a person in Montenegro to another country or to an international organisation, under Article 41, unless one of the Article 42 exceptions applies, including transfer to an EU or EEA Member State or a country on the EU adequacy list, the data subject's informed consent, or performance of a contract.
- Assess the adequacy of protection in the destination country against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law and security measures in force there, under Article 41, paragraph 2.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 41 allows a transfer abroad only to a recipient that applies adequate protection and on the prior consent of the supervisory authority, and Article 42 lists the cases where that consent is not needed. Neither states a duty to create, keep or produce a log or record of a transfer. The Article 19 record of third parties and users and the Article 26 record of each filing system, which carries the transfers, are outside the cited articles. Article 5, the territorial scope clause, is not cited by this row, so no hook is recorded.
- Kind
- None
- As of
What this law does
Article 41 permits personal data to be transferred from Montenegro to another country, or given to an international organisation that implements the safeguards this law requires, only with the prior consent of the supervisory authority, with the adequacy of the protection assessed against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law and security measures in force there.
Article 42 lists nine cases in which that consent is not mandatory, including a separate law or treaty providing for the transfer, the data subject's informed prior consent, performance of a contract, protecting the data subject's life, a transfer from a public register, an important public interest or legal claim, and a transfer to a Member State of the European Union or European Economic Area, or to a country on the European Union's adequacy list. The Law as first enacted came into force on and has applied since .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .