Montenegro

Article 31 permits biometric measures, meaning the establishment and comparison of a person's traits by processing biometric data in order to establish and prove their identity, to be performed in accordance with this law.

Article 32, paragraph 1 lets the public sector, meaning the state authority, public administration body, local self-government and local administration authority, commercial enterprise or other legal person and an entrepreneur exercising public authority, apply biometric measures in connection with entry into business or official premises and the presence of employees at work, if a law prescribes the measures.

Under Article 32, paragraph 2 the measures may be prescribed where necessary for the safety of persons or property or to protect secret data or business secrets, if that cannot be achieved another way, or to carry out obligations under international treaties and establish the identity of persons crossing the state border. The Law as first enacted came into force on 30 December 2008 and has applied since 30 June 2009.

The Law on Personal Data Protection published in Official Gazette of Montenegro No. 79/2008 is in force. A new Law on Personal Data Protection, published in Official Gazette of Montenegro No. 133/2026, enters into force on 19 September 2026 and applies from 19 March 2027.

Article 4a lets a state authority, public administration body, local self-government or local administration authority, commercial company or other legal person, entrepreneur or natural person be the controller of a personal data filing system.

Article 5 binds controllers of personal data filing systems that process personal data on the territory of Montenegro, or outside it where Montenegrin rules apply under international law, and a controller established or domiciled outside Montenegro if the equipment used for processing is in Montenegro, unless it is used only to transit data through Montenegro.

Article 5 also requires a controller in that situation to designate a representative or agent, seated or domiciled in Montenegro, who is responsible for applying the law. Article 7 applies the law to processing of personal data carried out wholly or partly by automatic means, or otherwise where the data form or will form part of a personal data filing system.

Article 10 permits processing with the data subject's prior consent, which may be withdrawn at any time, or without it where processing is necessary for one of five listed grounds, running from a legal obligation of the controller to an interest of the controller or a third party that has a basis in law, unless that interest has to be limited to protect the person's rights and freedoms.

A controller may entrust specific processing activities to a processor only by a written contract under Article 16, which regulates their mutual rights and obligations, in particular the processor's duty to follow the controller's instructions, and only to a processor that meets the conditions for implementing technical, personnel and organizational protection measures.

Article 24 requires the controller and the processor to implement technical, personnel and organizational safeguards appropriate to the nature of the data processed, to protect against loss, destruction, unauthorized access, alteration, disclosure and abuse.

Article 25 requires officials and other persons who process personal data in a state body, local government, company or other legal person to act only on the instructions of the head of the body or the responsible person, and to keep secret the personal data they learn in their work. Article 26 requires the controller to keep records of the personal data filing systems it establishes.

Article 27 requires the controller, before establishing an automatic filing system, to send the supervisory authority a notification containing the data listed in Article 26, paragraph 2, and to do the same on a significant change in processing. After establishing an automatic filing system, the controller must designate a person responsible for personal data protection, unless it has fewer than 10 officials who process personal data.

Article 28 requires the controller to obtain the supervisory authority's consent before automatic processing that poses a special risk to the rights and freedoms of persons, in particular where special categories of data or data used to assess personality, ability or behavior are to be processed, public-area video surveillance is to be introduced, or biometric data are to be processed, and does not apply where the processing rests on a law, the person's consent or a contract with the person.

Article 29 provides that the supervisory authority keeps the Register of the records of personal data filing systems. Article 33 lets a public-sector body, company, other legal person or entrepreneur require a person entering business or official premises to state the reason for entry, give personal data and, if needed, show an identification document.

Article 34 provides that the personal data in a record of entries and exits are kept for no longer than one year from collection and then deleted, unless a law provides otherwise. Article 35, paragraph 1 lets a public-sector body, company, other legal person or entrepreneur use video surveillance of access to official or business premises for the safety of persons and property, control of entry and exit, or, because of the nature of the work, a possible risk to employees.

Article 35 requires that video surveillance not show recordings of the interior of residential buildings unconnected with the entrance to official and business premises, or of apartment entrances. Article 36, paragraph 2 does not allow video surveillance in official and business premises outside the workplace, in particular in cloakrooms, elevators, sanitary rooms and the space intended for clients and visitors.

Article 37 provides that the personal data in a video surveillance record are kept for no longer than six months from creation. Article 38 allows video surveillance of the entrances and common areas of a residential building with the written consent of the owners' assembly, given by members holding more than 70% of the ownership, and bars video surveillance of apartment entrances.

Article 39 requires a body, company or entrepreneur using video surveillance to display a public notice of it in a visible place so that persons learn of it before it starts, and no later than when it starts. The Law as first enacted came into force on 30 December 2008 and has applied since 30 June 2009. The provisions this entry describes came into force on different days.

Article 2 applies the law to processing of personal data by automated means, and to processing by other means where the data form part of, or are intended to form part of, a filing system; it excludes processing by a natural person in the course of a purely personal or household activity and processing by competent authorities for the prevention, investigation, detection or prosecution of criminal offences.

Article 3 applies it to processing in the context of the activities of a controller's or processor's establishment in Montenegro, and to processing of the personal data of people in Montenegro by a controller or processor with no establishment there where the processing relates to offering them goods or services or to monitoring their behavior in Montenegro.

Article 6 sets the principles of lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality, and makes the controller responsible for being able to show compliance.

Article 7 permits processing only where at least one of six bases is met, among them the data subject's consent, performance of a contract, a legal obligation and the legitimate interests of the controller or a third party, and the legitimate-interest basis is not available to public authorities performing their tasks.

Article 9 makes a child's consent to an information society service valid only from the age of 16, and below that age only if the holder of parental responsibility gives or authorizes it. Article 10 prohibits processing special categories of personal data, among them biometric data processed to uniquely identify a natural person, unless one of ten listed conditions, such as the data subject's explicit consent, is met. The law enters into force on 19 September 2026 and applies from 19 March 2027.

Under Article 105, the Law on Personal Data Protection published in Official Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24 stops being valid on the day this law begins to apply, so that earlier law keeps governing until 19 March 2027, except that its Articles 35 to 40a on video surveillance stop being valid only on the day a law regulating video surveillance enters into force.

Article 41 permits personal data to be transferred from Montenegro to another country, or given to an international organisation that implements the safeguards this law requires, only with the prior consent of the supervisory authority, with the adequacy of the protection assessed against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law and security measures in force there.

Article 42 lists nine cases in which that consent is not mandatory, including a separate law or treaty providing for the transfer, the data subject's informed prior consent, performance of a contract, protecting the data subject's life, a transfer from a public register, an important public interest or legal claim, and a transfer to a Member State of the European Union or European Economic Area, or to a country on the European Union's adequacy list. The Law as first enacted came into force on 30 December 2008 and has applied since 30 June 2009.

Article 11 was deleted by the 2012 amendments (Official Gazette of Montenegro No. 44/12) and is no longer law; the right to have unlawfully processed data erased now rests on Articles 23 and 44.

Article 20 requires the controller, unless a special law provides otherwise, to give a person from whom it collects data directly notice of its name and address, the purpose and legal basis of processing, the third party or user and the legal basis for disclosing to it, whether giving the data is mandatory or voluntary and the consequences of refusing, and the rights of access and rectification.

Article 21 imposes a similar duty, no later than immediately before processing begins, where the data were not collected directly from the person, with an exception for statistical or scientific research use and processing prescribed by law where notice is impossible or disproportionate. Article 23 requires the controller to erase personal data, on the person's request, if their processing does not comply with the law, and suspends access to the data while the request is being decided.

Article 43 requires the controller to tell a person, on written request and within 15 days of the request, whether personal data concerning him are processed, and if they are, the controller's identity, the content of the data, the purpose and legal basis, the source and the third party or user. Article 44 requires the controller, on written request and within 15 days, to supplement or alter incomplete data, erase inaccurate data and erase data whose processing does not comply with the law.

Article 44 also requires the controller to notify the person and any third party of the change within eight days, and gives a person whose request is refused the right to object to the controller or seek protection from the supervisory authority.

Article 45 lets the rights in Articles 43 and 44 be restricted for defence, national and public security, the prevention, detection and prosecution of criminal offences, the protection of economic or financial interests, or the protection of the person or the rights and freedoms of others, to the extent necessary and in accordance with a special law, and Article 46 puts the cost of an Article 43 or 44 proceeding on the controller.

The Law as first enacted came into force on 30 December 2008 and has applied since 30 June 2009. The provisions this entry describes came into force on different days.

Article 47 lets a person who alleges a breach of rights under this law submit a request for protection of rights to the supervisory authority, which must decide by ruling within 60 days, and lets it temporarily ban further processing on the applicant's written request while a breach is likely and pending decision. Article 48 makes the controller liable for damage a person suffered from a breach of rights under this law, under the general rules on compensation of damage.

Article 49 sets up the Agency for Personal Data Protection as the supervisory authority, autonomous and independent, with legal personality. Articles 66 and 67 give the Agency's controllers the right of access to personal data, files, documentation and electronic processing means regardless of the level of data secrecy, and oblige controllers, users and processors to allow it.

Article 71 lets the Agency, in supervision, order irregularities eliminated, temporarily ban unlawful processing, order erasure of data collected without a legal basis, ban a transfer of personal data out of Montenegro or disclosure to users contrary to the law, and ban entrusting processing to a processor that does not meet the conditions.

Article 74, as replaced by the 2012 amendments (Official Gazette of Montenegro No. 44/12), fines a legal person EUR 500 to EUR 20,000 for the listed violations of this law. For the same violations it fines a responsible person in a legal person, a state body, a state administration body or a local government body, and an individual, EUR 150 to EUR 2,000. For the same violations it fines an entrepreneur EUR 150 to EUR 6,000.

The Law as first enacted came into force on 30 December 2008 and has applied since 30 June 2009. The provisions this entry describes came into force on different days.

Article 9 defines special categories of personal data as data relating to racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, health or sex life. Article 9 defines biometric data generically, without enumerated examples, as data on physical or physiological characteristics that every natural person has, that are specific, unique and unchangeable, and from which identity can be established directly or indirectly.

Article 12 requires personal data concerning minors to be processed in accordance with the law, in a manner that is in the best interest of the minor.

Article 13 permits processing special categories of data only with the person's explicit consent, where necessary for employment under the law governing employment relations with adequate safeguards, for detecting, preventing or diagnosing illness and treating the person or managing health services when a health worker or another person under a secrecy duty processes the data, to protect the vital interests of the person or of another who cannot consent, or in other cases a law prescribes, where the person has manifestly made the data public or processing is necessary to exercise or protect their legal interests before a court or other body, or in the lawful activity of a non-governmental organization, association or other non-profit body with political, philosophical, religious or trade-union aims, for its members and persons in regular contact only and without disclosure absent their consent.

Article 13 requires special categories of data to be distinctively designated and protected against unauthorized access. Article 14 confines the processing of personal data on criminal offences, imposed criminal and misdemeanor penalties or security measures to the competent state authority or its supervision, with safeguards required by law. The Law as first enacted came into force on 30 December 2008 and has applied since 30 June 2009. The provisions this entry describes came into force on different days.

Article 353(1) punishes unauthorised access to a computer system, in whole or in part, with a fine or imprisonment of up to one year; the basic offence does not require defeating a security measure. Article 353(2) raises the maximum to three years where the perpetrator violates a computer system's protection measures or accesses a system significant to a state authority, local-government authority, or another institution exercising public powers.

Article 353(3) applies the same three-year maximum to illegally intercepting non-public computer data during its transmission to, from, or within a computer system, including electromagnetic emissions. Article 353(4) punishes using data obtained through any of paragraphs 1 to 3 with a fine or up to three years, rising under Article 353(5) to a term of six months to five years where that use has grave consequences for another person. No commencement notice for this article has been located in the Official Gazette.

Article 139(1) gives the maker of a database who proves a qualitatively or quantitatively substantial investment in obtaining, verifying or presenting its contents the right to prohibit extraction or reuse of the whole contents or of a qualitatively or quantitatively substantial part. Extraction means the permanent or temporary transfer of all or a substantial part of the contents to another medium by any means or in any form.

Reuse means making all or a substantial part of the contents available to the public by distributing copies, renting, online transmission or other forms of transmission. Article 139(4) prohibits repeated and systematic extraction or reuse of insubstantial parts of the contents where that runs against the database's normal use or causes unreasonable harm to the maker's legitimate interests. The right applies whether or not the database or its contents qualify for copyright or other protection.

Under Article 143, the maker of a database made available to the public may not prevent a lawful user from extracting or reusing its qualitatively or quantitatively insubstantial parts. A lawful user may not, under Article 143, act in a way that conflicts with the database's normal exploitation and unreasonably prejudices the maker's legitimate interests. Contract terms that allow departures from those rules are void.

Article 144 lets a lawful user of a database made available to the public extract or reuse a substantial part without the maker's permission in listed cases, including a non-electronic database for private purposes, teaching or scientific research with the source named and a non-commercial purpose, and public security or administrative or judicial proceedings.

Article 144 also lets a research organization or cultural heritage institution extract or reuse under the conditions of Article 50a, and other persons under those of Article 50b. Article 50a permits a research organization or cultural heritage institution to copy works it lawfully accesses for text and data mining solely for scientific research.

Article 50b permits copying of lawfully accessible works solely for text and data mining unless the rightholder has expressly reserved that use in an appropriate way. For works made available to the public online, that reservation must be made by machine-readable means. Article 52's private-use reproduction exception expressly excludes electronic databases from its own scope.

Protection lasts from the day the database is made until 1 January of the year following the expiry of 15 years from that day. If the database is made available to the public within that period, protection lasts until 1 January of the year following the expiry of 15 years from its first publication. A substantial qualitative or quantitative change to the contents that results in a new investment starts a new 15-year term.

Article 145a extends the right to databases whose makers or rightholders are Montenegrin nationals or residents, or companies established under Montenegrin law with their registered seat or main place of business in Montenegro. Paragraphs 4 and 5 of Article 145a extend it to databases whose makers or rightholders are nationals or residents of, or companies established in, a European Union Member State.

Under Article 206d, Article 145a(4) to (6) applies only from the day Montenegro accedes to the European Union. Article 145b applies to the rights of database makers, with the necessary changes, the Act's provisions on protection of rights, foreign elements and supervision, among others. Law 53/2016 was published in the Official Gazette of Montenegro on 11 August 2016. Under its Article 38, it enters into force on the eighth day from the day of its publication. It replaced Article 139 with the text now in force. It also added Article 145a after Article 145.

Article 4 defines an essential entity as an organ or other entity that applies information and communication technology to deliver a service so significant to life, health, citizen safety or state functioning that its interruption or destruction would endanger them, and an important entity as one delivering a service whose interruption would only impair state functioning; both definitions apply regardless of the entity's size.

Article 19 places essential entities within eleven named sectors (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space) and important entities within seven others (postal and courier services, waste management, chemicals manufacture, food production, manufacturing of medical devices, electronics, electrical equipment, machinery or motor vehicles, online marketplace services, and research).

Articles 20 to 26 set the mechanics for the Government to adopt and maintain a Government-approved List of essential and important entities from sectoral proposals the competent ministries compile.

A designated entity carries the enhanced risk-management measures of Article 16 (a risk and security analysis, an incident-handling policy, a business-continuity and cyber-crisis plan, a supply-chain security act, system-governance acts, cryptographic protection where required, and an effectiveness assessment of these measures) on top of the general measures this jurisdiction's companion row describes, and, if designated an essential entity, must obtain a certificate of compliance with the Montenegrin standard MEST ISO/IEC 27001 from an accredited body within 30 months of the law's entry into force and request a periodic re-verification afterward (Article 18(4) to (6) and Article 73).

The Cybersecurity Agency launched its first supervision cycle in July 2026, sending questionnaires to designated essential and important entities and completing an on-site inspection of at least one essential entity, and reported that essential entities showed higher self-assessed compliance than important entities.

Article 2 binds every state organ, ministry, local self-government body, legal entity exercising public authority, business company, other legal entity and natural person that accesses or processes data, or uses and manages a network and information system, in Montenegro.

Article 18(2) requires every such organ or entity that the Government has not designated an essential or important entity to apply the data-protection measures of Article 12 (rules for handling data, access logging, and security oversight), the physical-protection measures of Article 14, and the network-and-information-system-protection measures of Article 15 (protecting the confidentiality, integrity and availability of data through the planning, design, construction, use, maintenance and decommissioning of that system), and Article 18(3) requires every organ or entity, designated or not, to name an employee to monitor its own compliance with these measures.

An essential or important entity carries the same Article 12, 14 and 15 duties as part of the wider Article 11 to 16 measures this jurisdiction's companion row on essential and important entities describes.

Article 28 requires every organ and other entity to assess the impact of a cyber threat or incident on the continuity of the services it provides, by the number of users affected, the duration, and the geographic reach. Article 29 requires an assessment of no impact to be reported once a month to the Cybersecurity Agency, or to the Government CIRT for a state administration body.

Article 30 requires an assessment of possible significant impact to be reported within 24 hours of becoming aware of it, on a prescribed form; the Agency or CIRT then rates the incident low, medium or high under Article 31.

A medium-rated incident carries a 72-hour first report, further reports without delay on any new development, continuing reports every 72 hours while it lasts, and a final report within 30 days of resolution (Article 33); a high-rated incident carries the same sequence on continuing reports every 24 hours instead (Article 34), and a high-rated incident the Agency and CIRT cannot resolve within ten days can be escalated to a Government-declared cyber crisis under Article 35.

Article 59 requires a provider of an audiovisual media service on demand to make content that could impair a minor's physical, health-related, moral, mental, intellectual, emotional or social development available only in a way least likely for minors to ordinarily encounter it, using measures that include content categorisation and age-verification tools.

It requires content that could seriously impair that development, including pornography or gratuitous depiction of violence, to be made available only behind the highest level of technical protection, such as a special code or identity verification. Personal data of a minor collected through either measure may not be processed for commercial purposes such as direct marketing, profiling, or targeted behavioural advertising.

Article 130 imposes a parallel duty on a video-sharing platform provider to establish and apply an age-verification system for platform users in relation to content that could endanger a minor's psychological, physical or moral development, among the protective measures the Agency for Audiovisual Media Services oversees. The Law was published on 11 June 2024 and entered into force on 19 June 2024.

Article 187 fines a legal person 500 to 20,000 euros, and sets lower tiers for a responsible person in a legal entity, a natural person, or an entrepreneur, for failing to comply with either duty, as a misdemeanor rather than a criminal offense.

Article 50 permits, without acquiring the corresponding economic right or paying remuneration and to the extent justified by the purpose of information, reproducing works seen or heard in the course of reporting a current event, preparing and reproducing summaries of disclosed newspaper and similar articles in the form of press reviews, and using political speeches and extracts from public lectures or similar works, though the author retains the exclusive right to compile such speeches or extracts into a collection.

Article 53 separately permits using quotations of a disclosed work in another work for the purpose of criticism, recognition, or reference, provided the quotation accords with fair practice and does not exceed the extent the purpose requires.

Neither provision states a headline-length or short-extract cap distinct from the purpose-justified and fair-practice tests, and no reported Montenegrin decision applies either provision to a systematic news aggregator rather than an individual user quoting or summarising a published work. The Act was published in Official Gazette of Montenegro No. 37/2011 of 29 July 2011.

Its Article 209 provides that it enters into force on the eighth day from the day of its publication, and no notice stating the resulting day has been located.