Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consent

Law on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 12 months, effective 4 October 2025.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.
Process personal data about a criminal conviction or offence only under the supervision of a public authority or where a special law authorizes it with safeguards for the person's rights, and keep any register of criminal convictions exclusively under a public authority's control, under Article 12.
Treat a child's consent to an information-society service offered directly to them as lawful only from age 16, and below that age obtain or verify the consent of a parent, adoptive parent, or guardian, making reasonable efforts to confirm it given available technology, under Article 10.

What it reaches

Obligation class

Prohibition, Consent, Biometric, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 11 prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, and processing genetic data, biometric data for uniquely identifying a person, health data, or data about a person's sex life or sexual orientation, unless one of the listed exceptions in Article 11(2) applies, chief among them the person's explicit consent, employment or social-security law, a vital interest, or a substantial public interest carried by a proportionate law.

Article 11(4) lets a specific law add further conditions, including limitations, on processing genetic, biometric or health data. Article 12 confines processing personal data about a criminal conviction, offence or related security measure to the supervision of a public authority or to a special law with safeguards, and keeps a register of criminal convictions exclusively under a public authority's control.

Article 10 makes a child's consent to an information-society service offered directly to them lawful from age 16, and below that age lawful only where a parent, adoptive parent or guardian gives or approves it, with the controller required to make reasonable efforts to verify that consent given available technology.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
serves_minors
handles_health_records

Read the law

Official English-language statute PDF hosted by the Agency for Statistics of Bosnia and Herzegovina (bhas.gov.ba)
read in full (207,438 characters, untruncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app