Bosnia and Herzegovina. Comprehensive data protection. Act
ZZLP 2025Law on Personal Data Protection of Bosnia and Herzegovina, Official Gazette of BiH No. 12/25
In force
Partly verified
Medium confidence.Sources conflict on entry into force (DLA Piper: 2025-03-08; one CEELM summary suggested a later date). Transition length for existing processing to be confirmed.
§1Summary
- Synopsis
A new GDPR-aligned state-level law that replaces BiH's 2006 Act, adding extraterritorial scope, accountability, DPOs, 72-hour breach notification and turnover-based fines.
- Key themes
- Unique features
Fines up to BAM 40m or 4% of global turnover, plus personal fines for executives and employees.
- SaaS relevance
Applies to SaaS providers offering services to or monitoring people in BiH; non-BiH providers must appoint a local representative.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Agency within 72h where possible; individuals if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy/safeguards (GDPR-style)
- Maximum penalty
- BAM 40m or 4% of global annual turnover (higher)
§3Dates
- Key dates
- Adopted
- In force
- Adopted by House of Representatives 2025-01-23 and House of Peoples 2025-01-30; published 2025-02-28; two-year transition for existing processing (to ~March 2027); replaced 2006 Law
§4Text and authority
- Text
- Authoritative text bhas.gov.ba
- Authority
- Personal Data Protection Agency of Bosnia and Herzegovina (AZLP)
§5Where it applies
- Domestic law of
- Bosnia and Herzegovina
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Sources conflict on entry into force (DLA Piper: 2025-03-08; one CEELM summary suggested a later date). Transition length for existing processing to be confirmed.