North MacedoniaLaw on Personal Data Protection (LPDP), personal data breach notification
Zakon za zastita na licnite podatoci, arts. 37-38 (personal data breach notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Agency of a personal data breach immediately and no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and give reasons for any delay beyond 72 hours.
- As a processor, notify the controller immediately after becoming aware of a personal data breach.
- Document every personal data breach, including its facts, consequences and the action taken, so the Agency can verify compliance.
- Notify the affected data subject immediately of a personal data breach likely to cause a high risk to their rights and freedoms, unless an exception such as prior encryption, later mitigation, or disproportionate effort applies.
These lines are LexLint's reading of the law's text.
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 37(5) requires the controller to document every personal data breach, notified or not, including the facts, its consequences and the action taken, so that the Agency can verify compliance with article 37. Article 37(1) to (4) is the 72-hour notice to the Agency and art. 38 is the notice to the data subject, which are notices and not records. The documented items are not log-content values. The article states no retention period for the breach record and does not say the record is produced to the Agency on request, so no disposition is coded.
- Kind
- Explicit
- As of
- Provision
- Article 37(5)
- Trigger
- security_incident
What this law does
Articles 37 and 38 carry North Macedonia's personal data breach notification duties, and under Article 122 as amended Chapter IV, where both articles sit, applies until North Macedonia's accession to the European Union.
Article 37, paragraph 1 requires a controller to notify the Agency of a personal data breach immediately and no later than 72 hours after becoming aware of it, unless the breach is unlikely to create a risk to the rights and freedoms of natural persons, and to give reasons when the notice is not filed within 72 hours. Article 37, paragraph 2 requires a processor to notify the controller immediately after becoming aware of a breach.
Article 37, paragraph 5 requires the controller to document every breach, including its facts, consequences and the action taken, so the Agency can verify compliance. Article 38, paragraph 1 requires a controller to notify the data subject immediately of a breach that is likely to cause a high risk to the rights and freedoms of natural persons.
Article 38, paragraph 3 makes that notice unnecessary where the controller applied protective measures such as encryption that make the data unintelligible, took later measures that remove the high risk, or would face disproportionate effort.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .