North Macedonia. Comprehensive data protection. Act

LPDPLaw on Personal Data Protection, Official Gazette No. 42/2020 (as amended 294/2021, 101/2025)

In force

Partly verified

Medium confidence. Adoption date (2020-02-16) and transition end from prior knowledge; in-force date verified.

§1Summary

Synopsis

North Macedonia's GDPR-aligned data protection law, covering rights, accountability, DPOs, breach notification and transfers, with fines imposed through a misdemeanour commission.

Key themes

principles
data subject rights
DPO
DPIA
breach notification
video surveillance
transfers

Unique features

GDPR-style turnover-based fines (2%/4%) imposed via the Agency's misdemeanour commission; detailed video surveillance rules.

SaaS relevance

Applies to SaaS providers established in or targeting North Macedonia; foreign controllers need a local representative.

§2Obligations

Extraterritorial: Yes
Breach notification: Agency within 72h; individuals if high risk
DPO: Conditional
Cross-border transfers: Adequacy/SCCs/Agency approval
Maximum penalty: Up to 4% of annual worldwide turnover

§3Dates

Key dates

Adopted 16 February 2020
In force 24 February 2020
18-month transition to 2021-08-24; Security Rulebook 2024 applies from 2025-07-01

§4Text and authority

Text

Authoritative text dzlp.mk

Authority

Personal Data Protection Agency (AZLP)

§5Where it applies

Domestic law of: North Macedonia

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Adoption date (2020-02-16) and transition end from prior knowledge; in-force date verified.