MontenegroLaw on Personal Data Protection (2026), scope, principles, lawful basis and special categories
Law on Personal Data Protection Official Gazette of Montenegro No. 133/2026, arts. 1-10 and 105-106 (scope, principles, lawful basis, special categories, repeal of the 2008 Law and application)
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent
As of .
What it requires
- Have one of the lawful bases Article 7 lists, such as the data subject's consent, performance of a contract or a legal obligation, before processing the personal data of a person in Montenegro, and be able to show that you comply with the principles in Article 6.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.MT-P3
- Where you rely on consent, be able to prove it, ask for it in clear and plain language that is distinct from other matters, and let the person withdraw it as easily as they gave it, as Article 8 requires.NIST Privacy FrameworkCT.PO-P1
- Do not process the personal data of a child under 16 for an information society service on the child's own consent; obtain the consent or authorization of the holder of parental responsibility, as Article 9 requires.NIST Privacy FrameworkCT.PO-P1
- Do not process special categories of personal data, including biometric data used to uniquely identify a person, unless one of the conditions in Article 10 applies, such as the data subject's explicit consent.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 2 applies the law to processing of personal data by automated means, and to processing by other means where the data form part of, or are intended to form part of, a filing system; it excludes processing by a natural person in the course of a purely personal or household activity and processing by competent authorities for the prevention, investigation, detection or prosecution of criminal offences.
Article 3 applies it to processing in the context of the activities of a controller's or processor's establishment in Montenegro, and to processing of the personal data of people in Montenegro by a controller or processor with no establishment there where the processing relates to offering them goods or services or to monitoring their behavior in Montenegro.
Article 6 sets the principles of lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality, and makes the controller responsible for being able to show compliance.
Article 7 permits processing only where at least one of six bases is met, among them the data subject's consent, performance of a contract, a legal obligation and the legitimate interests of the controller or a third party, and the legitimate-interest basis is not available to public authorities performing their tasks.
Article 9 makes a child's consent to an information society service valid only from the age of 16, and below that age only if the holder of parental responsibility gives or authorizes it. Article 10 prohibits processing special categories of personal data, among them biometric data processed to uniquely identify a natural person, unless one of ten listed conditions, such as the data subject's explicit consent, is met. The law enters into force on and applies from .
Under Article 105, the Law on Personal Data Protection published in Official Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24 stops being valid on the day this law begins to apply, so that earlier law keeps governing until , except that its Articles 35 to 40a on video surveillance stop being valid only on the day a law regulating video surveillance enters into force.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, processes biometric data or processes voice recordings.