Europe. National jurisdiction.

Kosovo XK

Primary authority: Information and Privacy Agency (IPA / AIP)

Part I

Domestic law

Comprehensive data protection1

LPPDLaw No. 06/L-082 on Protection of Personal DataIn force
In force from 13 February 2019Kosovo's GDPR-transposing data protection law, establishing the Information and Privacy Agency and GDPR-style rights, obligations and breach notification.
Synopsis
Kosovo's GDPR-transposing data protection law, establishing the Information and Privacy Agency and GDPR-style rights, obligations and breach notification.
Key themes
- principles
- data subject rights
- DPO
- breach notification
- transfers
Unique features
GDPR-based but with misdemeanour fines (€20,000–€40,000) and up to 2% of turnover for serious breaches.
SaaS relevance
Applies to SaaS providers processing data of people in Kosovo.
Extraterritorial
Yes
Breach notification
IPA within 72h; individuals if high risk
DPO
Conditional
Cross-border transfers
Adequacy/safeguards
Maximum penalty
€40,000 or 2% of prior-year turnover for serious violations
Key dates
- Adopted January 2019
- In force 13 February 2019
Text
- Authoritative text gzk.rks-gov.net
Authority
Information and Privacy Agency (IPA / AIP)
Sources consulted
- dlapiperdataprotection.com
Verification
Medium confidence.
Partly verified
Medium confidence. XK is a user-assigned ISO code. Any 2025–26 replacement bill not checked.
Record
Full record for LPPD
Partly verified
Medium confidence. XK is a user-assigned ISO code. Any 2025–26 replacement bill not checked.