Kosovo. Comprehensive data protection. Act
LPPDLaw No. 06/L-082 on Protection of Personal Data
In force
Partly verified
Medium confidence.XK is a user-assigned ISO code. Any 2025–26 replacement bill not checked.
§1Summary
- Synopsis
Kosovo's GDPR-transposing data protection law, establishing the Information and Privacy Agency and GDPR-style rights, obligations and breach notification.
- Key themes
- Unique features
GDPR-based but with misdemeanour fines (€20,000–€40,000) and up to 2% of turnover for serious breaches.
- SaaS relevance
Applies to SaaS providers processing data of people in Kosovo.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- IPA within 72h; individuals if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy/safeguards
- Maximum penalty
- €40,000 or 2% of prior-year turnover for serious violations
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text gzk.rks-gov.net
- Authority
- Information and Privacy Agency (IPA / AIP)
§5Where it applies
- Domestic law of
- Kosovo
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.XK is a user-assigned ISO code. Any 2025–26 replacement bill not checked.