🇲🇪Law on Personal Data Protection
Montenegro Law on Personal Data Protection - current consolidation
The official consolidated text reviewed for this page incorporates amendments through Official Gazette No. 77/24. It applies to automated processing and to filing-system processing, with territorial and representative rules in Article 5.
Core duties and special procedures
Consent and sensitive data: Articles 10-15 establish consent and heightened conditions for sensitive data. Minor processing relies on a parent, adopter or guardian and must respect the child's best interests. Direct marketing involving sensitive data requires explicit consent.
Notice, security and governance: Articles 20-25 address information duties, security and electronic access logging. Article 27 addresses advance database notification and appointment of a responsible person in specified circumstances.
Prior approval and surveillance: Article 28 requires advance Agency approval for specified high-risk automated processing, subject to its exceptions. Articles 35-40a set detailed video-surveillance conditions, including purpose, notice, access and residential-building decision rules.
Transfers and rights: Articles 41-42 govern transfers and prior approval or exceptions; Article 43 onward provides access and related individual rights.
Before deploying biometric access control, determine whether Article 28 prior approval is required, document necessity and safeguards, complete any Article 27 notification, restrict access logs and avoid treating a generic GDPR DPIA as the whole legal process.
Articles 5, 10-15a - scope, representation, consent, minors, sensitive data and automated decisions.
Articles 20-28 - notices, security, logging, notification and prior approval.
Articles 35-42 - surveillance and international transfers.
Article 43 onward - individual rights and enforcement.