Ensure your business complies with North Macedonia's Law on Personal Data Protection (ZZLP). Learn the similarities with GDPR, international data transfer rules, and key compliance strategies.
If you do business in the Republic of North Macedonia, you need to comply with the Macedonian Law on Personal Data Protection. The General Data Protection Regulation of the European Union fully aligns with the Macedonian Law on Personal Data Protection, implying that adhering to EU data protection legislation typically also entails adhering to the Macedonian privacy law.
Explore more privacy compliance insights and best practices
There is only one small difference: the international transfer of personal data. This article will look at the similarities and differences and suggest ways to comply.
Finally, Secure Privacy has a built-in module for compliance with the North Macedonian Law on Personal Data Protection (ZZLP) that can help you comply effortlessly.
The Law on Personal Data Protection of North Macedonia (LPDP, or ZZLP, according to the local abbreviation for Zakon za Zastita na Licnite Podatoci) is the Macedonian national legislation on data protection. In 2020, North Macedonia passed the Law on Personal Data Protection, which became enforceable in 2022.
North Macedonia is a candidate for EU membership and is currently aligning its national legislation with the EU's legislation. For this reason, the country's data protection law fully aligns with the EU's GDPR.
The Law on Personal Data Protection adheres to GDPR's material and territorial principles, meaning it applies to your business if
Personal data in ZZLP is defined as any information that could identify an individual, directly or indirectly.
This is fully in line with how the GDPR defines personal data. So, everything from personal names and unique government-issued ID numbers to browsing history and health issues is considered personal data under the ZZLP.
Data controllers and data processors are responsible for the following tasks:
Yes, in most cases, you need to obtain explicit user consent to process personal data.
The opt-in principle underpins Macedonian law, which prohibits data processing without a legal basis, typically involving the user's consent.
The consent must be freely given, specific to the processing purpose, unambiguous, and informed. As a result, data controllers and processors must not process personal data without explicit consent.
This means informing users what you'll use their data for, letting them decline, and not forcing consent. If they consent to processing, you must use the data solely for that purpose.
You need to show users a privacy policy to comply with the Macedonian ZZLP. In fact, before collecting their data, you must show users a privacy notice that informs them about data processing. Privacy policy is the most common way of providing data subjects with information about data processing activities.
Every privacy policy should include at least the following:
Every data subject in North Macedonia has the same rights as EU users when it comes to the protection of personal data. These include:
If a data subject submits a data subject request, you have 30 days to comply with it. For more complex requests, the deadline is 60 days.
Users can use whatever submission methods they want. Keep in mind that not responding to these requests appropriately is one of the most common reasons to have issues with the data protection authority anywhere in Europe.
The only real difference between the two laws, despite the law's full alignment with the GDPR, is international data transfers. In short, the rules for transfers are as follows:
You must report data breaches to the agency within 72 hours. You must also inform data subjects if the breach impacts their rights and freedoms.
You must provide the information in a separate piece of communication. You cannot bundle the breach notification with the marketing emails, for example. It has to be separate.
Some processing activities necessitate conducting a Data Protection Impact Assessment before processing data. It is obligatory for:
The Agency for Personal Data Protection enforces the ZZLP. It investigates data protection violations and imposes penalties.
The penalties can go as high as 2% or 4% of the annual turnover of the violator, depending on the severity of the violation. On certain occasions, companies can also impose fines of a few hundred euros on responsible individuals.
