Law No. 06/L-082 on Protection of Personal Data

Law No. 06/L-082 on Protection of Personal Data is Kosovo's general, General Data Protection Regulation (GDPR)-modelled data protection statute, and Article 1(2) states that the law aligns with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Article 2(3) extends the law to a controller or processor not established in Kosovo that uses automatic or other equipment there to process personal data, other than equipment used only for transit through Kosovo, and requires such a controller or processor to appoint a registered representative in Kosovo.

Article 4 sets the general processing principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, and Article 5 lists the lawful bases for processing, led by the data subject's consent.

Articles 23 to 30 set the controller's and processor's general obligations, covering accountability and data protection by design and by default, arrangements between joint controllers, a written representative-appointment duty, a written contract governing a processor's activities, a written record of processing activities, and cooperation with the Agency for Information and Privacy on request.

Article 29(4) exempts an undertaking or organisation employing fewer than two hundred and fifty people from the records-of-processing duty unless the processing risks data subjects' rights, is not occasional, or involves special categories of data or criminal-offence data.

Articles 35 and 36 require a data protection impact assessment before high-risk processing, such as systematic and extensive automated evaluation with legal or similarly significant effects, large-scale special-category processing, or large-scale systematic monitoring of a publicly accessible area.

Articles 37 to 39 require a Data Protection Officer where processing is carried out by a public authority, where core activities require regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special categories of data or criminal-offence data, and Articles 40 to 43 add internal-acts, codes-of-conduct and certification duties.

Article 73 lets a controller use personal data collected from public sources for direct marketing, limited to name, address, telephone number and email address unless the data subject has separately consented, and requires written consent before using sensitive personal data for that purpose.

Articles 75 to 90 hold this regime's remaining sector-specific processing rules, covering notice, retention and placement limits for video surveillance, an access-control cross-reference to the entry and exit records chapter, a three-year retention cap on building entry and exit logs, and restrictions on interconnecting filing systems, none of which this split gives its own family row.

Article 111 sets the law's entry into force at fifteen days after its publication in the Official Gazette of the Republic of Kosovo, which places entry into force on 12 March 2019 rather than the Gazette's own 25 February 2019 publication date.