Clym Logo
ME flagME

Personal Data Protection Law (PDPL) - Montenegro: Complete Compliance Guide

Overview

The Montenegro Personal Data Protection Law  establishes comprehensive rules for safeguarding individuals’ personal data. It aligns with international standards and human rights treaties, addressing data processing, storage, and transfer. The law ensures the protection of personal data against unauthorized access, misuse, or loss, with specific provisions for sensitive data like biometrics and criminal records. It applies to various entities within Montenegro and those outside using data processing equipment within the country.

Consumer Rights

Montenegro Consumer Rights Under the PDPL

The PDPL grants three individual privacy rights to Montenegro residents. Businesses must respond to authenticated requests within 15 days.

Find out about your data

Request access to the information we have collected about you

15-day response window
Update your data

Correct inaccurate or incomplete information we have collected about you

15-day response window
Delete your data

Delete personal information we have collected about you

15-day response window
Clym for PDPL Compliance

How Clym Helps You Comply with the Personal Data Protection Law (PDPL) - Montenegro

Consumer RightsAutomated DSR Management

Clym's Data Subject Request portal handles every PDPL request type, with built-in 15-day deadline tracking and escalation alerts.

Privacy NoticeAuto-Generated Privacy Notice

Clym scans your site and generates your PDPL-compliant privacy notice, updated automatically when new trackers or data categories are detected.

Book a demoStart free trial — no credit card

Regulation Summary

  • December 22, 2008 – Law published in the Official Gazette.
  • June 22, 2009 – Law comes into effect.
  • March 22, 2010 – Deadline for compliance with personal data filing system requirements.
  • December 22, 2010 – Deadline for compliance with video surveillance and record-keeping requirements.
  • April 3, 2017 - amended definitions and increased supervisory authority powers to align with EU standards.
  • July 3, 2024 - further amendments to align Montenegro’s law with the GDPR.

  • Entities with a registered office or domicile in Montenegro processing personal data.
  • Foreign businesses using Montenegrin infrastructure for data processing must designate a local representative.

  • Defense, national/public security, and pre-trial or criminal proceedings (unless otherwise stated in separate laws).
  • Personal or household data processing, unless made public.

  • Obtain consent where required, but allow processing for legal obligations, contracts, public interest, and legitimate interests.
  • Ensure data accuracy and secure storage.
  • Conduct processing in line with legal requirements for special categories of data.
  • Maintain records of processing activities.
  • Appoint a Data Protection Officer (DPO) when required.

  • Publish a privacy policy outlining processing details.
  • Allow data subjects to access, correct, or delete their data.
  • Manage cookies and tracking mechanisms with proper consent.
  • Implement mechanisms for users to exercise their rights.

  • Cross-border data transfers require approval from AZLP, unless certain conditions apply.
  • Parental consent is required for processing children’s data.
  • Processing sensitive data requires legal justification or explicit consent.

  • Right to information & access.
  • Right to rectification & erasure (Right to be Forgotten).
  • Right to restriction & objection to processing.

  • Supervised by the Agency for Personal Data Protection (AZLP).
  • Entities: A fine ranging from 10x to 300x the minimum wage in Montenegro (approx. $5,775 – $173,200 USD).
  • Responsible persons: A fine ranging from 1x to 20x the minimum wage (approx. $577.50 – $11,550 USD).
  • Sanctions include data deletion, processing bans, and corrective measures.