🇧🇦Law on Personal Data Protection
← Back to laws in Bosnia and Herzegovina
Law on Personal Data Protection, Official Gazette BiH No. 12/25
The law has applied since 4 October 2025. Articles 5-6 address territorial reach, including qualifying processing by organisations outside Bosnia and Herzegovina.
Core controller and processor duties
Lawfulness and children: Articles 8-12 cover lawful bases, consent, age-16 digital consent, special-category data and criminal-offence data.
Rights: Article 14 sets the normal 30-day response period and possible 60-day extension. Articles 23-24 address direct-marketing objection and automated decisions.
Accountability: Article 29 covers certain foreign representatives; Articles 30 and 32 cover processors and records; Articles 34-38 cover security, 72-hour regulator notification, high-risk communication, DPIAs and prior consultation; Articles 39-41 cover DPOs.
Transfers and local rules: Article 46 onward regulates transfers. Articles 57a-57b contain national video-surveillance and biometric provisions, including video-system logs retained for at least 12 months and a two-thirds consent rule for specified residential surveillance decisions.
A controller that formerly reported filing systems to the Agency should stop using the repealed registration model and maintain its own Article 32 processing records under the new law.
Articles 5-14 - scope, legal bases, children, sensitive data and response timing.
Articles 23-41 - rights, representation, processors, records, security, breaches, DPIAs and DPOs.
Article 46 onward; Articles 57a-57b - transfers, surveillance and biometrics.