Montenegro

Article 31 permits the establishment and comparison of personal traits for the purpose of establishing and proving the identity of an individual, defined as biometric measures, to be performed in accordance with this law.

Article 32 confines biometric measures carried out by the public sector, meaning the state authority, public administration body, local self-government and local administration authority, commercial enterprise or other legal person and an entrepreneur exercising public authority, to the entry into business or official premises and the presence at work of employees, and only where provided for by law and necessary for the protection of individuals and property, the protection of secrecy of data or business secrets, discharging obligations under international treaties, or establishing the identity of individuals crossing state borders, where these aims cannot be achieved another way.

This is the working resolution of a genuinely unresolved status question: whether the 2008 Law on Personal Data Protection, as amended through the August 2024 amendment (OG 77/24), or a separately reported 2023 replacement (OG No. 21/2023) currently governs, and it is recorded as enacted rather than in force because no promulgation, publication or commencement date for the act or any of its four amendments is available at primary source.

This law binds the state authority, public administration body, local self-government and local administration authority, commercial enterprise and other legal person, entrepreneur and natural person, with the seat or domicile in Montenegro, and a controller whose seat or domicile is outside Montenegro if the equipment used for processing personal data is situated in Montenegro, under Article 5.

Article 7 applies the law to processing personal data wholly or partly by automatic means, and to processing otherwise than by automatic means that forms part of, or is intended to form part of, a personal data filing system.

Article 10 permits processing with the data subject's prior consent, or without it where processing is necessary for one of five listed grounds running from performance of a legal obligation to a legitimate interest that does not override the data subject's rights and freedoms.

A processor of personal data may be entrusted specific processing activities only by way of a written contract under Article 16, and only where the processor is registered for carrying out the processing of personal data and can guarantee technical, personnel and organizational protection measures.

Article 24 requires the controller and the recipient of personal data to implement technical, personnel and organizational safeguards appropriate to the nature of the data processed, and Article 25 requires every officer and employee who processes personal data to keep it secret.

Article 26 requires the controller to keep records of every personal data filing system it establishes, and Articles 27 and 28 require the Agency's prior consent before establishing or materially altering one, with the Agency's silence for 30 days counting as consent.

Articles 33 to 40 let business and official premises keep entry and exit records and run video surveillance for safety and security purposes, subject to a public notice, a bar on recording residential interiors or apartment entrances, and a one year storage limit.

Article 41 permits personal data to be transferred from Montenegro to another country, or given to an international organisation that implements the safeguards this law requires, only with the prior consent of the supervisory authority, with the adequacy of the protection assessed against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law and security measures in force there.

Article 42 lists nine cases in which that consent is not mandatory, including a separate law or treaty providing for the transfer, the data subject's informed prior consent, performance of a contract, protecting the data subject's life, a transfer from a public register, an important public interest or legal claim, and a transfer to a Member State of the European Union or European Economic Area, or to a country on the European Union's adequacy list.

Article 11 lets a data subject request erasure of personal data that was not obtained from him directly, and requires the controller to erase it within 30 days of the request.

Article 20 requires the controller or processor to give a data subject, from whom data are collected directly, information including the purpose of processing, the recipients or categories of recipients, and the existence of the rights of access and rectification, and Article 21 imposes the same duty, no later than when processing begins, where the data were not obtained from the data subject directly.

Article 23 lets a data subject request erasure of personal data whose processing does not comply with the law, and requires the controller to notify the data subject and any recipient of an alteration, supplementing or erasure within 8 days.

Article 43 requires the controller to notify a data subject, on written request, within 15 days of whether personal data concerning him are undergoing processing, the identity of the processor and recipient, the source, purpose and legal grounds, and the rights of access and rectification, and Article 44 requires the controller, within the same 15 days, to supplement, alter or erase inaccurate or incomplete personal data, or block the use of personal data whose use does not comply with the law.

Article 45 lets the rights set out in Articles 43 and 44 be restricted for defence, national and public security, the detection and prosecution of criminal offenders, or the protection of economic or financial interests or cultural assets of importance for the state, to the extent necessary and only under a separate law, and Article 46 puts the cost of an Article 43 or 44 proceeding on the controller.

Article 47 lets a person who alleges a breach of rights under this law submit a request for protection of rights to the Agency, which must decide within 60 days, and lets the Agency temporarily ban further processing on the applicant's written request while a likely breach is pending decision. Article 48 entitles a data subject to compensation from the controller for damage suffered from a breach of rights under this law, under the general rules on compensation of damage.

Article 49 sets up the Agency for Personal Data Protection as the supervisory authority, autonomous and independent, with legal personality, and Articles 65 to 73 give the Agency's controllers the right of access to filing systems, files and electronic processing means regardless of the level of data secrecy, and let the Agency, on finding unlawful activity, order that irregularities be eliminated, impose a temporary ban on unlawful processing, order the erasure of unlawfully collected data, and ban an unlawful transfer or entrusting of personal data.

Article 74 fines an authority, legal person or entrepreneur ten to three hundred times the minimum wage in Montenegro, and a responsible individual one to twenty times the minimum wage, for violating the duties this law imposes.

Article 9 defines special categories of data as personal data concerning racial or ethnic origin, political, religious or other beliefs, social origin, trade union membership, health, sex life or sexual orientation, biometric data, and data from registers of misdemeanour and criminal convictions, with biometric data itself defined generically, without enumerated examples, as data on physical or physiological features intrinsic to every natural person that are specific, unique and unchangeable and capable of revealing identity directly or indirectly.

Article 12 requires personal data concerning children to be processed in a manner that is in the best interest of the child.

Article 13 permits processing special categories of data only where the data subject has consented, where necessary for detecting, preventing or diagnosing illness or providing medical treatment by a health worker or another person under a professional secrecy duty, to protect the vital interests of the data subject or another person unable to consent, where the data subject has manifestly made the data public or processing is necessary to establish or protect a legal interest, or in the non-disclosed internal activities of a political, religious or other non-profit association, and requires special categories of data to be distinctively designated and protected against unauthorised access.

Article 14 confines the processing of personal data on criminal offences, criminal or misdemeanour penalties or security measures to the competent state authority or its supervision, with safeguards required by law.

Article 353(1) punishes unauthorised access to a computer system, in whole or in part, with a fine or imprisonment of up to one year; the basic offence does not require defeating a security measure. Article 353(2) raises the maximum to three years where the perpetrator violates a computer system's protection measures or accesses a system significant to a state authority, local-government authority, or another institution exercising public powers.

Article 353(3) applies the same three-year maximum to illegally intercepting non-public computer data during its transmission to, from, or within a computer system, including electromagnetic emissions. Article 353(4) punishes using data obtained through any of paragraphs 1 to 3 with a fine or up to three years, rising under Article 353(5) to a term of six months to five years where that use has grave consequences for another person.

Article 139 defines a database as a collection of independent data, works, or other materials arranged systematically and individually accessible, whose obtaining, verification, or presentation demanded a qualitatively or quantitatively substantial investment, and protects it under the Act's related-rights provisions regardless of any copyright eligibility.

Article 140 extends that protection to the database's entire contents, to any qualitatively or quantitatively substantial part, and to a qualitatively or quantitatively insubstantial part where it is extracted repeatedly and systematically in a way that conflicts with the database's normal exploitation and unreasonably prejudices the maker's legitimate interests.

Article 141 gives the maker the exclusive right to authorise or prohibit reproducing, distributing, renting, or making the database available to the public, and Article 142 confines an authorised user to insubstantial parts for any purpose and bars acts that conflict with the database's normal exploitation.

Article 144 limits these rights for teaching, private and internal-use reproduction, and official-proceedings use, and Article 145 sets the term at 15 years from the database's making, or from its first disclosure if disclosed within that period, restarting on a qualitatively or quantitatively substantial new investment in the database's contents.

The Act's exception catalogue names no text-and-data-mining or AI-training-specific exception, and Article 52's private-use reproduction exception expressly excludes electronic databases from its own scope.

Article 4 defines an essential entity as an organ or other entity that applies information and communication technology to deliver a service so significant to life, health, citizen safety or state functioning that its interruption or destruction would endanger them, and an important entity as one delivering a service whose interruption would only impair state functioning; both definitions apply regardless of the entity's size.

Article 19 places essential entities within eleven named sectors (energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space) and important entities within seven others (postal and courier services, waste management, chemicals manufacture, food production, manufacturing of medical devices, electronics, electrical equipment, machinery or motor vehicles, online marketplace services, and research).

Articles 20 to 26 set the mechanics for the Government to adopt and maintain a Government-approved List of essential and important entities from sectoral proposals the competent ministries compile.

A designated entity carries the enhanced risk-management measures of Article 16 (a risk and security analysis, an incident-handling policy, a business-continuity and cyber-crisis plan, a supply-chain security act, system-governance acts, cryptographic protection where required, and an effectiveness assessment of these measures) on top of the general measures this jurisdiction's companion row describes, and, if designated an essential entity, must obtain a certificate of compliance with the Montenegrin standard MEST ISO/IEC 27001 from an accredited body within 30 months of the law's entry into force and request a periodic re-verification afterward (Article 18(4) to (6) and Article 73).

The Cybersecurity Agency launched its first supervision cycle in July 2026, sending questionnaires to designated essential and important entities and completing an on-site inspection of at least one essential entity, and reported that essential entities showed higher self-assessed compliance than important entities.

Article 2 binds every state organ, ministry, local self-government body, legal entity exercising public authority, business company, other legal entity and natural person that accesses or processes data, or uses and manages a network and information system, in Montenegro.

Article 18(2) requires every such organ or entity that the Government has not designated an essential or important entity to apply the data-protection measures of Article 12 (rules for handling data, access logging, and security oversight), the physical-protection measures of Article 14, and the network-and-information-system-protection measures of Article 15 (protecting the confidentiality, integrity and availability of data through the planning, design, construction, use, maintenance and decommissioning of that system), and Article 18(3) requires every organ or entity, designated or not, to name an employee to monitor its own compliance with these measures.

An essential or important entity carries the same Article 12, 14 and 15 duties as part of the wider Article 11 to 16 measures this jurisdiction's companion row on essential and important entities describes.

Article 28 requires every organ and other entity to assess the impact of a cyber threat or incident on the continuity of the services it provides, by the number of users affected, the duration, and the geographic reach. Article 29 requires an assessment of no impact to be reported once a month to the Cybersecurity Agency, or to the Government CIRT for a state administration body.

Article 30 requires an assessment of possible significant impact to be reported within 24 hours of becoming aware of it, on a prescribed form; the Agency or CIRT then rates the incident low, medium or high under Article 31.

A medium-rated incident carries a 72-hour first report, further reports without delay on any new development, continuing reports every 72 hours while it lasts, and a final report within 30 days of resolution (Article 33); a high-rated incident carries the same sequence on continuing reports every 24 hours instead (Article 34), and a high-rated incident the Agency and CIRT cannot resolve within ten days can be escalated to a Government-declared cyber crisis under Article 35.

Article 59 requires a provider of an audiovisual media service on demand to make content that could impair a minor's physical, health-related, moral, mental, intellectual, emotional or social development available only in a way least likely for minors to ordinarily encounter it, using measures that include content categorisation and age-verification tools.

It requires content that could seriously impair that development, including pornography or gratuitous depiction of violence, to be made available only behind the highest level of technical protection, such as a special code or identity verification. Personal data of a minor collected through either measure may not be processed for commercial purposes such as direct marketing, profiling, or targeted behavioural advertising.

Article 130 imposes a parallel duty on a video-sharing platform provider to establish and apply an age-verification system for platform users in relation to content that could endanger a minor's psychological, physical or moral development, among the protective measures the Agency for Audiovisual Media Services oversees. The Law was published on 11 June 2024 and entered into force on 19 June 2024.

Article 187 fines a legal person 500 to 20,000 euros, and sets lower tiers for a responsible person in a legal entity, a natural person, or an entrepreneur, for failing to comply with either duty, as a misdemeanor rather than a criminal offense.

Article 50 permits, without acquiring the corresponding economic right or paying remuneration and to the extent justified by the purpose of information, reproducing works seen or heard in the course of reporting a current event, preparing and reproducing summaries of disclosed newspaper and similar articles in the form of press reviews, and using political speeches and extracts from public lectures or similar works, though the author retains the exclusive right to compile such speeches or extracts into a collection.

Article 53 separately permits using quotations of a disclosed work in another work for the purpose of criticism, recognition, or reference, provided the quotation accords with fair practice and does not exceed the extent the purpose requires.

Neither provision states a headline-length or short-extract cap distinct from the purpose-justified and fair-practice tests, and no reported Montenegrin decision applies either provision to a systematic news aggregator rather than an individual user quoting or summarising a published work.