North MacedoniaLaw on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisions
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- periodic
- Who audits it
- Regulator
What it requires
- Cooperate with the Personal Data Protection Agency's supervisors during a regular, irregular or control supervision, including granting access to premises, documents and equipment relevant to personal data processing.
- Compensate any person who suffers material or non-material damage from your infringement of this Law, as a controller, and as a processor where you did not comply with the Law's processor-specific obligations or acted outside or contrary to the controller's lawful instructions.
- Expect a misdemeanour fine of up to 2% of the controller or processor's total annual turnover for violating a Category I obligation Article 110 lists, or up to 4% for a Category II obligation Article 111 lists, alongside small fixed fines against the responsible individual.
- Expect a misdemeanour fine of 1,000 to 10,000 euros in denar equivalent against a controller that performs video surveillance, or processes personal data through one, contrary to Articles 89 to 92.
- Expect the Agency to bring a misdemeanour procedure only within two years of the day the violation was committed, since the statute of limitations runs from that day.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 111 sets the higher misdemeanour tier at up to 4% of a controller or processor legal entity's total annual turnover for the preceding business year (or preceding revenue if newer), for violations that include Articles 9, 10, 11, 13, 16 to 26, 28 and 48 to 53, alongside Articles 66, 83, 84, 86 and 88. Article 110 sets a lower tier at up to 2% of turnover, covering obligations that include Articles 12, 15, 29 to 43, 94, 96 and 106. Article 112 separately fixes a 1,000 to 10,000 euro fine, independent of turnover, against a controller for a video surveillance violation of Articles 89 to 92. Articles 110 and 111 each additionally fix small fines, denominated in euros but payable in denar equivalent, against the responsible individual: 300 to 500 euros for the responsible person at a legal entity, 100 to 500 euros for an official at a state administration body, and 100 to 250 euros for a natural person acting as controller or processor; Article 112's own individual fines run 100 to 500 euros throughout.
- Rule
- Turnover pct only
- As of
- Currency
- EUR
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Personal Data Protection Agency, North Macedonia's independent supervisory authority.
Enforcement record
Counts the decisions of the Agency's misdemeanor commission in 2025: 3 decisions on the 6 requests it could decide, two of which carry a fine. The same report counts 17 regular and 179 extraordinary supervisions (196 in all), which are inspections rather than sanctions. The report prints no fines total.
- As of
- Source link
- https://azlp.mk/wp-content/uploads/2026/04/AZLP-Godisen-izvestaj-2025-МК.pdf
- Actions per year
- 3
Settledness
- As of
- Open questions
- Does "вкупниот годишен приход" (total annual revenue) of a controller or processor legal entity in Article 111, paragraph 1 count only that entity's own revenue or also the revenue of the group it belongs to?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Agency and supervision provisions set up the Agency, give it powers to order information and to supervise (arts. 66, 104 to 106) and set the misdemeanor fines. They impose no log or record duty on a controller beyond the duty to put documents and data on view for a supervisor (art. 106). The records they require are the Agency's own: the register of data protection officers (art. 68), the annual report (art. 70) and the record of supervisions (art. 104(7)). The controller's record of processing and breach record are arts. 34 and 37(5), which are not cited on this row. Regular supervision runs under an annual programme the Agency director adopts (art. 104(2)), so a periodic regulator check is coded; the supervisor's findings record goes to the controller and no coded disposition describes that.
- Kind
- None
- As of
What this law does
The Personal Data Protection Agency, established by Chapter VI, is an independent and autonomous state body responsible for supervising the lawfulness of personal data processing in North Macedonia and for protecting the fundamental rights and freedoms of natural persons in relation to it.
Article 102, paragraph 1 defines supervision as systematic and independent control over the lawfulness of processing activities, covering in particular investigation, verification, guidance and prevention directed at controllers and processors. Article 106 requires a controller or processor to enable the supervisor's unhindered supervision, in particular by making available the documents, data and information the supervision requires, with a copy where needed.
It also requires the controller or processor to give the supervisor access to the premises and equipment where personal data are processed. Article 97, paragraph 1 gives every data subject the right to file a request with the Agency if they consider that the processing of their personal data violates the Law, without prejudice to any other administrative or judicial remedy.
Article 98, paragraph 1 gives any natural or legal person the right to effective judicial protection against a legally binding decision of the Agency concerning them. Article 99 gives a data subject who considers that their rights under the Law have been infringed the right to effective judicial protection against a controller or processor, exercised by a claim before the competent court.
Article 101, paragraph 1 gives any person who suffered material or non-material damage from an infringement of the Law the right to compensation from the controller or processor, and paragraph 2 makes a controller liable for damage caused by processing that infringes the Law and a processor liable only where it did not comply with the Law's processor-specific obligations or acted outside or contrary to the controller's lawful instructions.
Article 110 sets a lower misdemeanor tier at up to 2% of the controller's or processor's total annual turnover. Article 111 sets the higher misdemeanor tier at up to 4% of a controller or processor's total annual turnover for the preceding business year, for violations that include the principles, lawfulness and consent rules of Articles 9 to 11, the special-categories rule of Article 13 and the data subject rights of Articles 16 to 22.
Article 112 separately fixes a misdemeanor fine of 1,000 to 10,000 euros in denar equivalent against a controller for a video surveillance violation of Articles 89 to 92. A misdemeanor procedure cannot be initiated or conducted once two years have passed from the day the violation was committed.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .