North Macedonia's Data Protection Law: Ten Months To Comply

It has been exactly eight months since the Republic of North Macedonia adopted the new Law on Personal Data Protection ("Law"), largely in compliance with the GDPR, entering into force only a few days after it was promulgated. Controllers and processors were afforded 18 months in which to align their operations with the new Law. While some have already done so, others have 10 months to comply with the provisions.

Some of the most important novelties are set out below:

High penalties introduced in line with the GDPR

The Law prescribes significantly higher penalties for controllers and processors compared to the previous Law on Data Protection. Under the new Law, the fines are set at up to 4 % of the company's total annual income in the preceding financial year. Under the previously valid Law on Data Protection, the maximum fine was only EUR 2,000.