KosovoLaw No. 06/L-082 on Protection of Personal Data
Law No. 06/L-082 on Protection of Personal Data (Albanian: Ligji Nr. 06/L-082 per Mbrojtjen e te Dhenave Personale) arts. 1-6, 10, 23-32, 35-43, 73, 75-90 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, direct marketing lawful basis, and other sector-specific processing rules)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Consent, Security, DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis under Article 5 before processing personal data of a person in Kosovo, and apply the Article 4 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability throughout.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
- Appoint a registered representative in Kosovo if you are a controller or processor not established there but use automatic or other equipment in Kosovo to process personal data, unless that equipment is used only for transit through Kosovo.NIST Privacy FrameworkGV.PO-P5
- Apply data protection by design and by default, keep a written record of your processing activities unless you employ fewer than two hundred and fifty people and none of the high-risk, non-occasional or special-category exceptions apply, and cooperate with the Agency for Information and Privacy on request.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkID.IM-P4NIST Privacy FrameworkGV.PO-P5
- Carry out a data protection impact assessment before high-risk processing such as systematic automated evaluation with legal effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area, and consult the Agency first where the assessment shows a risk you cannot mitigate.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
- Appoint a Data Protection Officer if you are a public authority, or if your core activities require regular and systematic large-scale monitoring of data subjects or large-scale processing of special categories of data or criminal-offence data, and publish that officer's contact details to the Agency.NIST Privacy FrameworkGV.PO-P3
- Put appropriate technical and organisational security measures in place, proportionate to the risk, before and during processing.NIST Privacy FrameworkPR.DS-P5
- Use personal data collected from public sources for direct marketing only as Article 73 allows, limited to name, address, telephone number and email address unless the data subject has separately consented, and obtain written consent before using sensitive personal data for marketing.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Information and Privacy Agency of Kosovo (Agjencia per Informim dhe Privatesi) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://aip.rks-gov.net/download/guidelines-on-records-of-personal-data-processing-activities/?wpdmdl=3445
- Guidance body
- Information and Privacy Agency of Kosovo (Agjencia per Informim dhe Privatesi)
- Open questions
- Is an undertaking that employs exactly 250 persons within the exemption for one that "punëson më pak se dyqind e pesëdhjetë (250) persona" ("employs fewer than two hundred and fifty (250) persons"), given that the Agency's guidelines speak of a controller "employing over 250 employees"?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time
Logging duty
Article 29(1) requires every controller and processor to keep a written register of processing activities (Article 29(2)) and Article 29(3) requires it to be made available to the supervisory authority on request. The register names purposes, categories of data subjects and data, recipients, transfers, erasure periods and security measures, which are not log-content values. Article 6(1) says a controller relying on consent must be able to demonstrate that the data subject gave it, which implies a kept consent record. Article 76(6) requires a file system, kept apart from the recordings, that holds the date, place and time of each camera recording and where it is stored. Article 84 lets an organization record the entry and exit of people from its buildings and Article 84(4) caps that data at three years, and Article 76(7) caps camera recordings at one month; both are limits on how long the personal data may be kept, and Article 84 is optional, so neither is coded as a retention period for a record. Article 2(3) applies the law to a controller not established in Kosovo that uses automatic or other equipment in Kosovo; a rule that turns on where the means are located has no hook value, so the hook is empty. The Article 35 impact assessment in the cited range is a documented assessment made before processing, and Article 33(5) breach documentation sits in a sibling row.
- Kind
- Explicit
- As of
- Provision
- Article 29 (register of processing activities), with Article 6(1) (the controller must be able to demonstrate consent) and Article 76(6) (a file system for camera-surveillance recordings)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Law No. 06/L-082 on Protection of Personal Data is Kosovo's general, General Data Protection Regulation (GDPR)-modelled data protection statute, and Article 1(2) states that the law aligns with Regulation (EU) 2016/679 of the European Parliament and of the Council of .
Article 2(3) extends the law to a controller or processor not established in Kosovo that uses automatic or other equipment there to process personal data, other than equipment used only for transit through Kosovo, and requires such a controller or processor to appoint a registered representative in Kosovo.
Article 4 sets the general processing principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, and Article 5 lists the lawful bases for processing, led by the data subject's consent.
Articles 23 to 30 set the controller's and processor's general obligations, covering accountability and data protection by design and by default, arrangements between joint controllers, a written representative-appointment duty, a written contract governing a processor's activities, a written record of processing activities, and cooperation with the Agency for Information and Privacy on request.
Article 29(4) exempts an undertaking or organisation employing fewer than two hundred and fifty people from the records-of-processing duty unless the processing risks data subjects' rights, is not occasional, or involves special categories of data or criminal-offence data.
Articles 35 and 36 require a data protection impact assessment before high-risk processing, such as systematic and extensive automated evaluation with legal or similarly significant effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area.
Articles 37 to 39 require a Data Protection Officer where processing is carried out by a public authority, where core activities require regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special categories of data or criminal-offence data, and Articles 40 to 43 add internal-acts, codes-of-conduct and certification duties.
Article 73 lets a controller use personal data collected from public sources for direct marketing, limited to name, address, telephone number and email address unless the data subject has separately consented, and requires written consent before using sensitive personal data for that purpose.
Articles 75 to 90 hold this regime's remaining sector-specific processing rules, covering notice, retention and placement limits for video surveillance, an access-control cross-reference to the entry and exit records chapter, a three-year retention cap on building entry and exit logs, and restrictions on interconnecting filing systems, none of which this split gives its own family row.
Article 111 sets the law's entry into force at fifteen days after its publication in the Official Gazette of the Republic of Kosovo, which places entry into force on rather than the Gazette's own publication date.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .