Law on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjects

Law on the Protection of Personal Data, arts. 14-25, 67-74 (rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 12 months, effective 4 October 2025.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Tell a person, at the latest when you collect their personal data or within a reasonable period if collected elsewhere, who you are, the purpose and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, under Articles 15 and 16.
Answer a request for access, rectification, erasure, restriction, or portability under Articles 17 to 22, and notify any recipient the data were disclosed to of a rectification, erasure or restriction you make.
Stop processing personal data for direct marketing purposes as soon as a person objects, and give a person a right to obtain human intervention and express their view against a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, under Articles 23 and 24.
Give a person whose data a competent authority processes for a criminal-law purpose the same information, access, rectification, erasure and restriction rights under Articles 67 to 73, subject to the narrower grounds under Article 71 on which a competent authority may restrict or delay them.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Articles 14 to 16 require the controller to tell a person, in a concise, transparent, intelligible and easily accessible form, its identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and the person's rights, giving that information when the data are obtained or, where they come from elsewhere, within a reasonable period and at the latest one month afterward.

Article 17 gives a person the right to confirm whether their personal data are processed and to access them, Article 18 the right to have inaccurate data rectified, Article 19 the right to erasure on the listed grounds, and Article 20 the right to restrict processing; Article 21 requires the controller to tell every recipient the data were disclosed to of a rectification, erasure or restriction, unless that proves impossible or involves disproportionate effort.

Article 22 gives a right to receive personal data in a structured, commonly used and machine-readable format and to have it transmitted to another controller, and Article 23 gives a right to object to processing, including an unconditional right to object to direct marketing that stops the processing as soon as it is exercised.

Article 24 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, with a right to obtain human intervention and to express their point of view, and Article 25 lets a special law restrict these rights only where necessary and proportionate to a listed public interest.

Articles 67 to 74 carry the same information, access, rectification, erasure and restriction rights for a person whose data a competent authority processes for the prevention, investigation, detection or prosecution of a criminal offence, subject to Article 71's narrower grounds for restricting or delaying access in that context.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Official English-language statute PDF hosted by the Agency for Statistics of Bosnia and Herzegovina (bhas.gov.ba)
read in full (207,438 characters, untruncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app