Bosnia and Herzegovina (BiH) recently joined the group of non-E.U. countries that have based their data protection legislation on the E.U. General Data Protection Regulation (GDPR). The enactment of the law provided an opportunity for BDK Advokati to share with leading Bosnian companies our expertise gained from years of implementing the GDPR and Serbian law modelled after the GDPR. The parliament approved the law on 30 January 2025. On 18 February, we held a seminar on the new BiH law in Sarajevo, with the Foreign Investors Council (FIC) in BiH as the event’s co-host.
BDK Advokati’s Bogdan Ivanišević, senior partner, and Anja Gligorević, attorney at law, talked about the new law together with Samira Čampara, Assistant Director of the BiH Agency for the Protection of Personal Data, and Melika Bašić, Sarajevo-based attorney at law. More than fifty representatives from Bosnia’s leading companies attended the seminar.
The focus of the presentations was on the differences between the new BiH law and the 2006 law that was modelled after E.U. Data Protection Directive of 1995. The presentations also referred to numerous pronouncements of the E.U. and Member States’ courts and supervisory authorities, as authoritative sources that may help the authorities and practitioners in BiH to navigate through the complex GDPR-based rules.
Bogdan Ivanišević emphasised that the new principle of accountability requires data controllers not only to act in accordance with the principles but also to be able to demonstrate compliance. Bogdan elaborated on the legal bases of the processing, with a particular focus on the availability of legitimate interests and the stringent conditions for basing data processing on the data subject’s consent. Our head of data protection practice offered practical insights concerning data breach notification, data protection impact assessment, and position and tasks of the data protection officer. In the segment dedicated to the processing of personal data in the context of employment, Bogdan focused on the legal bases for the processing, internal investigations, and background checks. Samira Čampara followed up by providing her insights into the new law’s regime for processing employees’ biometric data.
Anja Gligorević first explained how the new law regulates the processing of special categories of personal data. In other segments of the seminar, Anja analysed the law’s provisions on the information to be provided to data subjects, the rights of data subjects, the relationship between data controllers and data processors, and the transfer of personal data abroad. The new law faithfully follows the approach present in the GDPR. One implication is that the transfer of personal data to neighbouring countries (such as Serbia and Montenegro) which are not E.U. member states will now require the use of appropriate safeguards or derogations for specific situations – unless the Bosnian government departs from the E.U. stance and grants adequacy status to the neighbouring countries.
Melika Bašić offered her insights on how the new law regulates the records of processing activities and the security of processing. In particular, Ms Bašić explained how the choice of appropriate technical and organisational measures to ensure an adequate level of security of processing is influenced by the state of the art, implementation costs, and the nature, scope, context, and purposes of the processing, and the risks for the rights and freedoms of data subjects.
Ms. Čampara, from the Agency for the Protection of Personal Data, guided the participants through the competencies and powers of the Agency under the new law. She also talked about legal remedies, the liability of controllers and processors, and penalties. It is worth noticing that the new DP Act provides for penalty amounts which are unusually high in the Bosnian context, up to EUR 20 million for certain violations.
For more information on data protection matters, please contact Bogdan Ivanišević (Bogdan.Ivanisevic@bdkadvokati.com) or Anja Gligorević (anja.gligorevic@bdkadvokati.com).
