North Macedonia

Article 122(24) defines child pornography, for the whole Criminal Code, as pornographic material that visually depicts explicit sexual acts with a minor or with an adult who looks like a minor, or that depicts a minor or an adult who looks like a minor in an explicit sexual position, and separately reaches realistic images depicting the same acts or positions, whether or not an actual minor was involved in producing them.

Article 193-a(1) punishes producing child pornography for the purpose of distributing it, or transmitting, offering or otherwise making it available, with imprisonment of at least five years; paragraph (2) punishes acquiring or possessing it with imprisonment of five to eight years; paragraph (3) raises the minimum to eight years where the offense is committed through a computer system or another mass-communication medium; paragraph (4) extends liability to a legal person, punishable by a fine.

Because the definition's realistic-image branch does not require a real child to have been depicted, an image an AI system generates that realistically depicts a minor, or a person who looks like a minor, in an explicit sexual act or position falls within it on the same terms as a photograph. No commencement notice for this article has been located in the Official Gazette.

Articles 37 and 38 carry North Macedonia's personal data breach notification duties, and under Article 122 as amended Chapter IV, where both articles sit, applies until North Macedonia's accession to the European Union.

Article 37, paragraph 1 requires a controller to notify the Agency of a personal data breach immediately and no later than 72 hours after becoming aware of it, unless the breach is unlikely to create a risk to the rights and freedoms of natural persons, and to give reasons when the notice is not filed within 72 hours. Article 37, paragraph 2 requires a processor to notify the controller immediately after becoming aware of a breach.

Article 37, paragraph 5 requires the controller to document every breach, including its facts, consequences and the action taken, so the Agency can verify compliance. Article 38, paragraph 1 requires a controller to notify the data subject immediately of a breach that is likely to cause a high risk to the rights and freedoms of natural persons.

Article 38, paragraph 3 makes that notice unnecessary where the controller applied protective measures such as encryption that make the data unintelligible, took later measures that remove the high risk, or would face disproportionate effort.

The Law on Personal Data Protection (LPDP), Official Gazette 42/2020, applies to wholly or partly automated processing of personal data and to other processing of personal data that forms part of, or is intended to form part of, a filing system.

The LPDP applies to a controller or processor established in North Macedonia and, where the processing relates to offering goods or services to data subjects from North Macedonia or to monitoring their behavior there, to a controller or processor established abroad. Article 5 of the amending law published in Official Gazette 294/2021 replaced the word "until" ("до") with the word "with" ("со") in Article 122.

As amended, Article 122 provides that Chapter II (except Article 12), Chapters III, IV (except Articles 46 and 47), V and VIII cease to apply with North Macedonia's accession to the European Union, so those chapters apply until accession.

Article 10 makes processing lawful only if at least one of its listed conditions is met, among them the data subject's consent for one or more specific purposes, necessity for a contract, a legal obligation of the controller, vital interests, a task in the public interest or an official authority, or the legitimate interests of the controller or a third party. Article 11, paragraph 1 requires a controller that relies on consent to be able to demonstrate that the data subject consented.

Article 11, paragraph 3 lets the data subject withdraw consent at any time and requires withdrawal to be as easy as giving consent. Article 28, paragraph 1 requires the controller to apply technical and organizational measures proportionate to the risk, to be able to demonstrate that processing complies with the Law, and to review and update the measures as needed. Article 29 requires data protection by design and by default, including measures such as pseudonymization and data minimization.

Article 34, paragraph 1 requires each controller and its authorized representative to keep a record of the processing operations it is responsible for. Article 36, paragraph 1 requires a controller and a processor to apply technical and organizational measures that ensure a level of security appropriate to the risk, including, as appropriate, pseudonymization and encryption of personal data.

Article 39, paragraph 1 requires a controller, before processing that is likely to result in a high risk to the rights and freedoms of natural persons, particularly when it uses new technologies, to carry out a data protection impact assessment.

Article 41, paragraph 1 requires a controller and a processor to designate a data protection officer where a public authority carries out the processing, where core activities involve regular and systematic large-scale monitoring of data subjects, or where core activities involve large-scale processing of special categories of data or of data on penal convictions and offenses.

Article 46, paragraph 2 makes certification voluntary and publicly available, and paragraph 3 provides that certification does not reduce a controller's or processor's responsibility for complying with the Law.

Article 81, paragraph 1 allows the Law's chapters on principles, data subject rights, controllers and processors, transfers and the Agency to be excluded or departed from in processing for journalistic purposes or academic, artistic or literary expression, where necessary to balance personal data protection against freedom of expression and information.

Article 82 lets a state authority, a state body or a legal entity exercising public powers disclose personal data from the official documents it holds in order to carry out tasks in the public interest under a special law, balancing public access to official documents against the right to personal data protection.

Article 83 lets a controller process a citizen's national identification number only with the data subject's prior explicit consent, for legally defined rights or duties of the data subject or the controller, or in other cases a law states, and makes systematic and extensive processing of it on the basis of consent subject to the Agency's prior approval.

Article 85, paragraph 1 lets a law or collective agreements set more specific rules to protect rights and freedoms in processing in the employment context, and paragraph 2 requires those rules to include suitable measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights.

Article 86, paragraph 1 requires a controller processing for archiving in the public interest, for scientific or historical research or for statistical purposes to apply appropriate safeguards for the rights and freedoms of the data subject. Those safeguards may include pseudonymization, provided the purposes can be achieved that way.

Article 96 allows processing for direct marketing, including the profiling connected to it, only with the data subject's prior explicit consent given under Article 11.

Articles 89 to 93 hold North Macedonia's dedicated video surveillance regime. A controller performing video surveillance must publish a clear, visible notice that it is in place. The notice must state that video surveillance is carried out, name the controller, and explain how to obtain information on where and for how long the recordings are kept. Article 89, paragraph 7 requires the controller to notify employees of video surveillance on official or business premises.

Article 89, paragraph 6 allows video surveillance only of the area sufficient for the goals for which it was installed. Article 90, paragraph 3 prohibits video surveillance in cloakrooms, changing rooms, toilets and similar rooms. Article 89, paragraph 8 allows recordings to be stored for no longer than 30 days unless another law sets a longer period with its own safeguards.

Under Article 89, paragraph 9 the owner of a camera installed contrary to the Law must take measures to remove it at their own expense. Article 91, paragraph 1 requires the written consent of at least 70% of the owners, tenants or lessees of the housing units for video surveillance in single-unit and multi-unit residential buildings.

Article 91 bars transmitting those recordings over cable television, the internet or other electronic means of data transmission, and bars recording the entrances to other owners' or tenants' individual apartments. Article 92, paragraph 1 requires the controller to analyze the goal of a video surveillance system before establishing it.

Article 92, paragraph 3 requires a periodic assessment of the system's results every two years, covering the continuing need for it, its goals and possible technical alternatives.

Chapter V, Articles 48 to 56, carries North Macedonia's cross-border transfer rules, and under Article 122 as amended it applies until North Macedonia's accession to the European Union. Article 48, paragraph 1 allows a transfer of personal data to a third country or an international organization only if the controller and processor meet the conditions the Law sets, including for onward transfers.

Article 48, paragraph 2 excludes from the chapter a transfer from North Macedonia to a member state of the European Union or of the European Economic Area, and paragraph 3 requires the controller or processor to notify the Agency of such a transfer.

Article 1 of the amending law published in Official Gazette 101/2025 added a NATO member state to the European Union and the European Economic Area in Article 48, paragraphs 2 and 3, so the exclusion and the notice duty also cover a transfer to a NATO member state. Article 2 of that amending law made the matching addition of NATO member states and NATO in Article 56.

Article 49, paragraph 1 allows a transfer to a third country or an international organization where the Agency has assessed that it ensures an adequate level of protection. Article 50, paragraph 1 allows a transfer without an adequacy decision only where the controller or processor has provided appropriate safeguards and data subjects have applicable and available judicial protection.

Article 50, paragraph 2 lets those safeguards, without prior approval of the Agency, take the form of legally binding and enforceable instruments between public authorities or bodies, binding corporate rules, or standard data protection clauses that the Agency sets or the European Commission approves.

Article 53, paragraph 1 allows a transfer without an adequacy decision or appropriate safeguards only on a listed ground, such as the data subject's explicit consent after being informed of the risks, or necessity for performing a contract between the data subject and the controller.

Article 26, paragraph 1 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. The right does not apply to a decision that is necessary for a contract between the data subject and the controller, that a law applying to the controller authorizes with suitable safeguards, or that rests on the data subject's explicit consent.

In the contract and consent cases the controller must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at a minimum the right to human intervention by the controller, the right to express a personal view and the right to contest the decision. Article 26, paragraph 4 bars basing those decisions on special categories of personal data unless Article 13, paragraph 2, point 1 or 7 applies and suitable safeguards are in place.

Chapter III, which carries Article 26, applies until North Macedonia's accession to the European Union, when it ceases to apply under Article 122 as amended.

Chapter III, Articles 16 to 27, carries the data subject rights the LPDP models on the General Data Protection Regulation (GDPR), and under Article 122 as amended it applies until North Macedonia's accession to the European Union. Article 16, paragraph 2 requires the controller to facilitate the exercise of the data subject's rights under Articles 19 to 26.

Article 19, paragraph 1 gives a data subject the right to obtain confirmation of whether their personal data are being processed and, where so, access to the data and to information including the purposes of the processing and the categories of data processed. The information also covers the recipients, the retention period and, where the data were not collected from the data subject, their source.

Article 20 gives a data subject the right to have inaccurate personal data rectified by the controller within 15 days of the request, and to complete incomplete data by a supplementary statement. Article 21, paragraph 1 gives a data subject the right to request erasure, which the controller must carry out within 30 days of the request where a listed ground applies.

The grounds include that the personal data are no longer needed for the purposes for which they were collected and that the data subject withdraws the consent on which the processing rests. Article 22 gives a right to restriction of processing, for example while the data subject contests the accuracy of the data.

Article 24, paragraph 1 gives a right to receive the personal data the data subject supplied in a structured, commonly used, machine-readable format and to transmit them to another controller without hindrance, where the processing rests on consent or a contract and is carried out by automated means.

Article 25, paragraph 2 gives a right to object at any time to processing for direct marketing, including the profiling connected to it, and under paragraph 3 the controller then stops processing the data for that purpose.

The Personal Data Protection Agency, established by Chapter VI, is an independent and autonomous state body responsible for supervising the lawfulness of personal data processing in North Macedonia and for protecting the fundamental rights and freedoms of natural persons in relation to it.

Article 102, paragraph 1 defines supervision as systematic and independent control over the lawfulness of processing activities, covering in particular investigation, verification, guidance and prevention directed at controllers and processors. Article 106 requires a controller or processor to enable the supervisor's unhindered supervision, in particular by making available the documents, data and information the supervision requires, with a copy where needed.

It also requires the controller or processor to give the supervisor access to the premises and equipment where personal data are processed. Article 97, paragraph 1 gives every data subject the right to file a request with the Agency if they consider that the processing of their personal data violates the Law, without prejudice to any other administrative or judicial remedy.

Article 98, paragraph 1 gives any natural or legal person the right to effective judicial protection against a legally binding decision of the Agency concerning them. Article 99 gives a data subject who considers that their rights under the Law have been infringed the right to effective judicial protection against a controller or processor, exercised by a claim before the competent court.

Article 101, paragraph 1 gives any person who suffered material or non-material damage from an infringement of the Law the right to compensation from the controller or processor, and paragraph 2 makes a controller liable for damage caused by processing that infringes the Law and a processor liable only where it did not comply with the Law's processor-specific obligations or acted outside or contrary to the controller's lawful instructions.

Article 110 sets a lower misdemeanor tier at up to 2% of the controller's or processor's total annual turnover. Article 111 sets the higher misdemeanor tier at up to 4% of a controller or processor's total annual turnover for the preceding business year, for violations that include the principles, lawfulness and consent rules of Articles 9 to 11, the special-categories rule of Article 13 and the data subject rights of Articles 16 to 22.

Article 112 separately fixes a misdemeanor fine of 1,000 to 10,000 euros in denar equivalent against a controller for a video surveillance violation of Articles 89 to 92. A misdemeanor procedure cannot be initiated or conducted once two years have passed from the day the violation was committed.

Article 12, paragraph 1 makes processing of a child's personal data for an information society service offered directly to the child lawful where the child is at least 14 years old, or, if younger, only where the child's legal representative has given or authorized the consent. Article 12, paragraph 2 requires the controller to make a reasonable effort to verify that the legal representative gave the consent, taking available technology into account.

Article 84, paragraph 1 requires the Agency's prior approval before processing data concerning health. It requires the same approval before processing genetic data, unless experts process it for the needs of preventive medicine, medical diagnosis or care and treatment of the data subject, and before processing biometric data.

Article 84, paragraph 2 extends the approval requirement to processing based on the data subject's explicit consent, and paragraph 3 makes it unnecessary where a law that contains safeguards determines the processing. Article 13, paragraph 1 prohibits processing of the special categories of personal data defined in Article 4, paragraph 1, point 13.

Article 13, paragraph 2 permits it where an exception applies, such as the data subject's explicit consent for one or more specific purposes, necessity in the field of employment and social security under a law or collective agreement, vital interests, the legitimate activities of a non-profit body, data the data subject has manifestly made public, legal claims, or an important public interest based on law.

Article 14 confines processing of personal data relating to convictions and offenses to processing under the control of a competent state authority, or where a law permits it with appropriate safeguards for the rights and freedoms of data subjects.

Article 2 of the amending law published in Official Gazette 294/2021 replaced the words "осуди за кривични дела" ("convictions for criminal offenses") in the first and second sentences of Article 14 with "казнени осуди и казнени дела" ("penal convictions and penal offenses").

Article 251(1) punishes a person who, without authorization, deletes, alters, damages, conceals or otherwise renders unusable computer data, a program, or a device for maintaining an information system, or disables or hinders the use of a computer system, data, program or computer communication, with a fine or imprisonment of up to three years.

Paragraph (2) applies the same penalty to unauthorized entry into another's computer or system with intent to exploit its data or programs for unlawful gain or to cause damage, or to transmit data reached without authorization. Paragraph (3) separately punishes unauthorized interception, by technical means, of a non-public transmission of computer data to, from or within a computer system.

Paragraph (4) raises the penalty to one to five years' imprisonment where the act targets a system protected by special security measures, one used by a state body, public enterprise or public institution, or in international communications, or is committed by a member of an organized group; paragraphs (5) and (6) raise it further where the act produced a greater unlawful gain or damage.

Paragraph (7) separately punishes the unauthorized manufacture, acquisition, sale, possession or distribution of a device, password, access code or program suited for committing the offense, and paragraph (9) extends liability to a legal person, punishable by a fine. The provisions this entry describes came into force on different days.

Article 51 allows a published work to be used without the author's permission, with or without remuneration, only in special cases that do not conflict with the work's normal exploitation and do not unreasonably prejudice the author's legitimate interests, and excludes a computer program from this part entirely.

Article 52(1) lists the permitted uses, including, at point 7, use of parts of a work (quotations) in scientific research, teaching, criticism, polemic or review, to the extent the specific purpose requires, with the author's name and source credited.

No provision read in this text creates an exception specific to text-and-data-mining or a machine-readable reservation mechanism of the kind the European Union's Digital Single Market Directive introduced, so training a model on text obtained from this jurisdiction rests only on whichever of the enumerated point-7 purposes, if any, the use can be characterized as. The Law was published in Official Gazette of the Republic of Macedonia No. 115 of 31 August 2010.

Its Article 201 provides that it enters into force on the eighth day from the day of its publication, and no notice stating the resulting day has been located.

Article 118 defines a database maker as a legal or natural person who has undertaken the initiative and responsibility for investing in the creation of a database, where that person shows a qualitatively and/or quantitatively substantial investment in obtaining, verifying or presenting its content. Article 119 gives the database maker the exclusive right to permit or prohibit extraction and/or re-utilization of the whole or a substantial part of the database.

Article 120 extends protection to insubstantial parts of a database's content where they are extracted or re-utilized repeatedly and systematically in a manner contrary to normal exploitation or that unreasonably prejudices the maker's legitimate interests, and excludes a computer program used to make or operate a database accessible by electronic means.

Article 52(2) exempts a lawful user's extraction or re-utilization of a database's contents from remuneration where necessary for access to and normal use of those contents. The Law was published in Official Gazette of the Republic of Macedonia No. 115 of 31 August 2010. Its Article 201 provides that it enters into force on the eighth day from the day of its publication, and no notice stating the resulting day has been located.

Article 4(2) applies the Law to medium and large entities that provide services in energy, transport, banking, the financial market, health, digital infrastructure and the management of ICT services. Article 4(3) applies the Law to all legal persons seated in the Republic that provide public electronic communications networks or services or trust services, whatever their size. Article 5(2) excludes the National Bank of the Republic of North Macedonia from the Law.

Article 61(2) defers the Law's application to the areas in points 8 to 16 of article 4(2) until North Macedonia accedes to the European Union. Article 62 provides that the Law enters into force on the eighth day after publication in the Official Gazette and applies from 1 January 2026. Article 32(1) obliges essential and important entities to take appropriate technical, operational and organisational measures proportionate to the risk.

Article 32(7) requires an entity that does not meet the article 32(3) measures to take corrective action immediately and within 30 days at the latest. Article 54(1) fines an essential entity up to 2% of its total annual revenue for failing to take the article 32 measures, unless a special law prescribes a higher fine.

Article 33(1) obliges essential and important entities to notify the competent computer incident response team immediately, and within three hours at the latest, of learning of a significant cyber security incident or significant cyber threat. Article 33(3) point 1 requires an early warning to the competent team within 24 hours of learning of a significant cyber security incident.

Article 33(3) point 2 requires an incident notification to the competent team within 72 hours of learning of a significant cyber security incident. Article 33(3) point 4 requires a final report to the competent team within one month of the incident notification. Article 33(4) requires a trust service provider to notify the competent team within 24 hours of learning of a significant cyber security incident that affects its trust services.

Article 33(2) requires entities, where possible, to inform the recipients of their services who may be affected by a serious cyber threat by the next working day at the latest. Article 54(1) fines an essential entity up to 2% of its total annual revenue for failing to notify the competent team of a significant cyber security incident.

Article 52(1)(6) permits, without the author's permission and without payment, the reproduction and public communication of articles, notes and other similar works on current economic, political, religious and other similar topics, for the purpose of informing the public, to the extent the purpose justifies, unless the author has specifically prohibited this, and provided the author's name and source are credited.

Article 52(3) separately permits, also free of charge and on the same author's-prohibition and crediting conditions, the public communication of the headline of an article, note or similar work on current affairs where it is taken up in an electronic publication from another electronic publication or another source for the purpose of informing the public.

Neither paragraph imposes a length cap on the excerpt beyond the purpose-justified test, and neither is restricted to press-industry actors, so on its own terms it reaches a news aggregator's headline and short-extract reproduction as readily as an individual publisher's. Article 51 conditions all of Part 4's exceptions, this one included, on the use not conflicting with the work's normal exploitation and not unreasonably prejudicing the author's legitimate interests. The sections this entry groups came into force on different days.