Montenegro. Comprehensive data protection. Act
ZZPL 2026Law on Personal Data Protection 2026 (new Zakon o zaštiti podataka o ličnosti)
Partly verified
Low confidence.Single secondary source; gazette number and publication date not confirmed. Status recorded as 'Enacted – not yet in force' because obligations apply only from 2027-03-19, although the Act formally entered into force 2026-09-19.
§1Summary
- Synopsis
A new GDPR-aligned law that replaces Montenegro's 2008 Act as part of EU accession alignment. It brings in accountability, GDPR-style rights, breach notification and turnover-based administrative fines once it applies in March 2027.
- Key themes
- Unique features
Two-tier administrative fines up to €2m or 4% of worldwide turnover sitting alongside a separate low misdemeanour regime; the two cannot be imposed for the same breach.
- SaaS relevance
From March 2027, SaaS providers targeting Montenegro will face GDPR-style obligations and turnover-based fines.
§2Obligations
- Extraterritorial
- Yes
- DPO
- Conditional
- Cross-border transfers
- GDPR-style adequacy/safeguards
- Maximum penalty
- €2m or 4% of worldwide annual turnover (higher); lower tier €1m or 2%
§3Dates
- Key dates
- Adopted
- In force
- Adopted by Parliament 2026-09-04; promulgated 2026-09-08; entry into force 2026-09-19 (8th day after publication); application from 2027-03-19
§4Text and authority
- Text
- Authoritative text sluzbenilist.me
- Authority
- Agency for Personal Data Protection and Free Access to Information (AZLP)
§5Where it applies
- Domestic law of
- Montenegro
§6Sources and verification
- Sources consulted
- Verification
Low confidence.
Partly verified
Low confidence.Single secondary source; gazette number and publication date not confirmed. Status recorded as 'Enacted – not yet in force' because obligations apply only from 2027-03-19, although the Act formally entered into force 2026-09-19.