🇲🇰Law on Personal Data Protection
← Back to laws in North Macedonia
Law on Personal Data Protection, Official Gazette No. 42/20, as amended
The law applies to automated and filing-system processing and includes an extraterritorial test in Article 3. It should be read with the amendments in Official Gazette Nos. 294/21 and 101/25.
Core controller and processor duties
Children and rights: Article 12 sets 14 as the age for a child's consent to directly offered information-society services. Article 16 provides the normal one-month response period, extendable by two months. Articles 25-26 address direct-marketing objection and automated decisions; Article 96 separately requires explicit consent for direct marketing.
Accountability: Article 31 covers certain foreign representatives; Articles 32 and 34 cover processors and records; Articles 36-40 cover security, 72-hour breach notice, high-risk communication, DPIAs and prior consultation; Articles 41-43 cover DPOs.
Transfers: Article 48 onward governs international transfers. Official Gazette No. 101/25 amended Articles 48 and 56 to add NATO-member-country references and required an implementing by-law within 15 days.
A platform relying on consent for a directly offered service must verify the age-14 rule, provide child-appropriate information, retain consent evidence and make sure profiling and automated decisions satisfy Articles 25-26.
Articles 3, 12 and 16 - territorial scope, children and response timing.
Articles 25-43 - objection, automation, representatives, processors, records, security, breaches, DPIAs and DPOs.
Article 48 onward - international transfers, read with the 2025 amendment.