North Macedonia
Law on Personal Data Protection (2020)
Authority
Agency for Personal Data Protection (AZLP)
Overview
North Macedonia’s Law on Personal Data Protection, adopted in February 2020 and applicable since August 2021, is one of the most GDPR-aligned frameworks in the Western Balkans. The law transforms the former Directorate into the Agency for Personal Data Protection (AZLP), equipping it with enhanced supervisory powers including the authority to approve standard contractual clauses and binding corporate rules. Data controllers must notify the AZLP of personal data breaches without undue delay and no later than 72 hours after becoming aware of the breach, unless the incident is unlikely to result in a risk to data subjects’ rights and freedoms. Where a breach poses a high risk, affected individuals must also be informed directly. Administrative fines reach up to 4% of total annual turnover for the most serious violations, with additional penalties for video surveillance non-compliance ranging from EUR 1,000 to EUR 10,000. The AZLP has published bilingual breach notification forms and maintains an online reporting portal. However, publicly available enforcement decisions remain scarce, and the regulator’s practical track record is still developing. Organizations should treat the 72-hour notification deadline as a hard compliance requirement while recognising that enforcement intensity may increase as the AZLP matures.