North MacedoniaLaw on Personal Data Protection (LPDP), transfer of personal data
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Transfer personal data to a third country or an international organization only where the Agency has assessed that it ensures an adequate level of protection, or where you have provided an appropriate safeguard such as binding corporate rules or standard data protection clauses and data subjects have available judicial protection.
- Know that the chapter's transfer conditions do not reach a transfer from North Macedonia to a member state of the European Union, the European Economic Area or NATO, though the controller or processor must still notify the Agency of it.
- Absent an adequacy decision or appropriate safeguards, transfer personal data to a third country only on a listed ground such as the data subject's explicit consent after being informed of the risks, or necessity for performing a contract.
These lines are LexLint's reading of the law's text.
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 53(6) requires a controller or processor that transfers on the compelling-legitimate-interests derogation to document its assessment and the safeguards in the art. 34 record, and art. 56 has the Agency's director prescribe the form, content and keeping of the record of transfers made to third countries and to EU or EEA states. Article 51(2)(ѕ) requires binding corporate rules to carry in-group verification mechanisms, including data protection audits, with the results available to the Agency on request; that duty attaches only to a transfer made on binding corporate rules and the Law states no interval for it. The documented assessment is not a log-content value. Art. 48(3) has a controller notify the Agency of a transfer to an EU or EEA state, which is a notice. The text read is the 2020 original; the 101/2025 amendment to these articles is not in it.
- Kind
- Explicit
- As of
- Provision
- Articles 53(6), 56 and 51(2)(ѕ)
- Trigger
- personal_data_processing
What this law does
Chapter V, Articles 48 to 56, carries North Macedonia's cross-border transfer rules, and under Article 122 as amended it applies until North Macedonia's accession to the European Union. Article 48, paragraph 1 allows a transfer of personal data to a third country or an international organization only if the controller and processor meet the conditions the Law sets, including for onward transfers.
Article 48, paragraph 2 excludes from the chapter a transfer from North Macedonia to a member state of the European Union or of the European Economic Area, and paragraph 3 requires the controller or processor to notify the Agency of such a transfer.
Article 1 of the amending law published in Official Gazette 101/2025 added a NATO member state to the European Union and the European Economic Area in Article 48, paragraphs 2 and 3, so the exclusion and the notice duty also cover a transfer to a NATO member state. Article 2 of that amending law made the matching addition of NATO member states and NATO in Article 56.
Article 49, paragraph 1 allows a transfer to a third country or an international organization where the Agency has assessed that it ensures an adequate level of protection. Article 50, paragraph 1 allows a transfer without an adequacy decision only where the controller or processor has provided appropriate safeguards and data subjects have applicable and available judicial protection.
Article 50, paragraph 2 lets those safeguards, without prior approval of the Agency, take the form of legally binding and enforceable instruments between public authorities or bodies, binding corporate rules, or standard data protection clauses that the Agency sets or the European Commission approves.
Article 53, paragraph 1 allows a transfer without an adequacy decision or appropriate safeguards only on a listed ground, such as the data subject's explicit consent after being informed of the risks, or necessity for performing a contract between the data subject and the controller.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .