North MacedoniaLaw on Personal Data Protection (LPDP)
Zakon za zastita na licnite podatoci (Law on Personal Data Protection) Official Gazette No. 42/2020 as amended by Official Gazette Nos. 294/2021 and 101/2025, fully applicable , arts. 1-11, 15, 28-47, 81-83, 85-87, 94-96 (general provisions, principles and controller obligations)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Governance, Disclosure, Consent
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Have one of the lawful grounds Article 10 lists, such as consent, necessity for a contract, a legal obligation, vital interests, a public-interest task or official authority, or legitimate interests, before processing personal data.
- Where processing rests on consent, be able to demonstrate that the data subject consented, present the request for consent clearly distinguishable from other matters, and let the data subject withdraw consent at any time as easily as it was given.
- Apply technical and organizational measures proportionate to the risk, keep them under review, and be able to demonstrate that your processing complies with the Law.
- Build data protection into your processing by design and by default, including pseudonymization and data minimization.
- Keep a record of the processing operations you are responsible for, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of natural persons, and designate a data protection officer where Article 41 requires one.
- Where a certification mechanism under Articles 46 and 47 is used, know that it is voluntary and does not by itself reduce responsibility for complying with the rest of this Law.
- Get the Agency's prior approval before any systematic and extensive processing of a citizen's national identification number, and otherwise process it only with the data subject's prior consent or another case a law states.
- Process personal data for direct marketing, including related profiling, only after the data subject has given explicit consent.
- Apply appropriate safeguards, such as pseudonymisation or data minimisation, when processing personal data for archiving in the public interest, or for scientific, historical or statistical purposes.
- Disclose personal data held in an official document only to fulfil a task in the public interest, reconciling public access to official documents with the right to data protection.
These lines are LexLint's reading of the law's text. Also read by: Agency for Personal Data Protection of North Macedonia (Агенција за заштита на личните податоци), the supervisory authority under the Law on Personal Data Protection (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://azlp.mk/informacija-za-primena-na-zakonot-za-zashtita-na-licnite-podatoci/
- Guidance body
- Agency for Personal Data Protection of North Macedonia (Агенција за заштита на личните податоци), the supervisory authority under the Law on Personal Data Protection
- Open questions
- Under Article 3, paragraph 2, when does a controller established outside North Macedonia engage in a 'понуда на стоки или услуги' (offering of goods or services) to data subjects 'од Република Северна Македонија' (from the Republic of North Macedonia), for example a service that is only accessible there and not directed at them?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 34 requires every controller and processor to keep a written or electronic record of its processing operations and to give the Agency access to it on request, except a company with fewer than 50 employees unless the processing is risky, non-occasional or involves special categories (art. 34(5)). Article 37(5) requires the controller to document every personal data breach, with the facts, effects and action taken, so the Agency can check compliance with art. 37. Article 11(1) requires the controller to demonstrate that the data subject consented, and art. 9(2) makes it accountable for the principles and obliges it to demonstrate compliance. Article 36(5) requires the controller and processor to demonstrate that security measures are applied, and art. 36(1) point (г) names a process of regular testing of those measures with no interval. The record's items (names, purposes, categories, recipients, transfers, erasure periods, security description) are not log-content values; the consent record is the only value that applies. Erasure periods listed in the register are a content item, not a retention period for the record. The article 3(2) 'from North Macedonia' wording turns on the data subject's origin and the coded hooks rest on the offer of goods or services and on behavior observed in the country. The text read is the Official Gazette 42/2020 original; amendments 294/2021 and 101/2025 are not in that text.
- Kind
- Explicit
- As of
- Provision
- Articles 34, 37(5), 11(1) and 9(2)
- Trigger
- personal_data_processing
- security_incident
- consent_or_optout
What this law does
The Law on Personal Data Protection (LPDP), Official Gazette 42/2020, applies to wholly or partly automated processing of personal data and to other processing of personal data that forms part of, or is intended to form part of, a filing system.
The LPDP applies to a controller or processor established in North Macedonia and, where the processing relates to offering goods or services to data subjects from North Macedonia or to monitoring their behavior there, to a controller or processor established abroad. Article 5 of the amending law published in Official Gazette 294/2021 replaced the word "until" ("до") with the word "with" ("со") in Article 122.
As amended, Article 122 provides that Chapter II (except Article 12), Chapters III, IV (except Articles 46 and 47), V and VIII cease to apply with North Macedonia's accession to the European Union, so those chapters apply until accession.
Article 10 makes processing lawful only if at least one of its listed conditions is met, among them the data subject's consent for one or more specific purposes, necessity for a contract, a legal obligation of the controller, vital interests, a task in the public interest or an official authority, or the legitimate interests of the controller or a third party. Article 11, paragraph 1 requires a controller that relies on consent to be able to demonstrate that the data subject consented.
Article 11, paragraph 3 lets the data subject withdraw consent at any time and requires withdrawal to be as easy as giving consent. Article 28, paragraph 1 requires the controller to apply technical and organizational measures proportionate to the risk, to be able to demonstrate that processing complies with the Law, and to review and update the measures as needed. Article 29 requires data protection by design and by default, including measures such as pseudonymization and data minimization.
Article 34, paragraph 1 requires each controller and its authorized representative to keep a record of the processing operations it is responsible for. Article 36, paragraph 1 requires a controller and a processor to apply technical and organizational measures that ensure a level of security appropriate to the risk, including, as appropriate, pseudonymization and encryption of personal data.
Article 39, paragraph 1 requires a controller, before processing that is likely to result in a high risk to the rights and freedoms of natural persons, particularly when it uses new technologies, to carry out a data protection impact assessment.
Article 41, paragraph 1 requires a controller and a processor to designate a data protection officer where a public authority carries out the processing, where core activities involve regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special categories of data or of data on penal convictions and offenses.
Article 46, paragraph 2 makes certification voluntary and publicly available, and paragraph 3 provides that certification does not reduce a controller's or processor's responsibility for complying with the Law.
Article 81, paragraph 1 allows the Law's chapters on principles, data subject rights, controllers and processors, transfers and the Agency to be excluded or departed from in processing for journalistic purposes or academic, artistic or literary expression, where necessary to balance personal data protection against freedom of expression and information.
Article 82 lets a state authority, a state body or a legal entity exercising public powers disclose personal data from the official documents it holds in order to carry out tasks in the public interest under a special law, balancing public access to official documents against the right to personal data protection.
Article 83 lets a controller process a citizen's national identification number only with the data subject's prior explicit consent, for legally defined rights or duties of the data subject or the controller, or in other cases a law states, and makes systematic and extensive processing of it on the basis of consent subject to the Agency's prior approval.
Article 85, paragraph 1 lets a law or collective agreements set more specific rules to protect rights and freedoms in processing in the employment context, and paragraph 2 requires those rules to include suitable measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights.
Article 86, paragraph 1 requires a controller processing for archiving in the public interest, for scientific or historical research or for statistical purposes to apply appropriate safeguards for the rights and freedoms of the data subject. Those safeguards may include pseudonymization, provided the purposes can be achieved that way.
Article 96 allows processing for direct marketing, including the profiling connected to it, only with the data subject's prior explicit consent given under Article 11.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .