Personal Data Protection and Internal Acts in Bosnia and Herzegovina

Comprehensive legal support in the field of personal data protection in BiH, focused on the drafting and/or alignment of internal acts with applicable regulations, as well as relevant judicial and inspection practice, while simultaneously providing legal support in relation to disputes, misdemeanor proceedings, and related regulatory matters in the area of personal data protection.

In practice, properly aligned internal acts related to personal data protection represent a key tool for clearly regulating rights and obligations, ensuring more efficient management of personal data, and reducing the risk of disputes and misdemeanor sanctions. In this context, establishing internal legal certainty through properly structured and compliant internal acts represents an important element of stable and responsible business operations.

A significant number of internal acts related to personal data protection constitute a legal obligation of a legal entity, and their failure to be adopted or their adoption in a manner not compliant with applicable regulations may expose a legal entity and its responsible person to misdemeanor sanctions. At the same time, certain internal acts, although not expressly prescribed as mandatory, represent recommended practice as they contribute to a clearer regulation of mutual rights and obligations. Certain internal acts also have particular significance from a regulatory perspective, especially in the context of the proper application of applicable personal data protection regulations in BiH.

We particularly note that the legal framework in the field of personal data protection in BiH is to a large extent regulated at the state level, through the adoption of the Law on Personal Data Protection of BiH, as well as by-laws adopted by the competent institutions. Supervision over the application of these regulations is carried out by the Personal Data Protection Agency of BiH, as an independent administrative organization at the state level. In this respect, this area is to a significant extent centralized in terms of the regulatory framework and supervision.

In BiH, the General Data Protection Regulation (GDPR) is not directly applicable, given that BiH is not a member of the European Union. However, the new Law on Personal Data Protection of BiH, which entered into force in 2025, is largely aligned with GDPR standards and introduces a similar level of personal data protection.

In practice, the application of GDPR standards may be relevant in situations where a legal entity from BiH cooperates with partners from the European Union or processes personal data of individuals located in the EU, in accordance with the rules on the extraterritorial application of the GDPR. In this context, compliance with GDPR principles often represents an additional standard contributing to legal certainty, business reliability, and the strengthening of trust among international partners.

Our One Stop Shop approach is based on a detailed understanding of applicable regulations and legal, judicial, and inspection practice, as well as on a clearly structured management of the process. We provide clients with precise guidance regarding the content and scope of the required documentation, as well as the sequence of actions, along with prior verification of the compliance of all elements before their implementation, whereby the identification of the required internal acts in the field of personal data protection is carried out in detail in accordance with the client’s registered business activities and specific business model. This contributes to the quality and legal certainty of internal acts, reduces the need for subsequent corrections, and minimizes the risk of disputes or actions by competent inspection authorities.

Through this approach, the client has a single point of contact throughout the entire process, with clear communication, efficiency, coordinated management of all activities, and regular written updates on all initiated or completed legal actions, thereby enabling a systematic and efficient implementation of projects while simultaneously relieving the client of organizational and administrative burdens.

Within this One Stop Shop, we provide, inter alia, the following services:

• legal advisory and analysis of applicable personal data protection regulations, as well as relevant legal, judicial, and inspection practice;
• drafting and/or alignment of internal acts in the field of personal data protection;
• provision of oral and/or written instructions for the proper implementation and application of internal acts in practice;
• preparation of submissions and requests to the Personal Data Protection Agency of BiH, as well as oral and/or written communication with its officials;
• legal advisory in the field of personal data protection.

Further information on our services in the field of personal data protection is available in the explanation below.

Below we provide a general overview of the most important internal acts in the field of personal data protection which, among others, we can prepare for our clients.