Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer

Article 46 lets a transfer to another country or international organisation take place only in compliance with this chapter, including an onward transfer. Article 47 lets a transfer proceed without further safeguards where the Council of Ministers, on the Agency's proposal, has decided that the destination ensures an adequate level of protection, a decision the Agency continuously reviews and reports on.

Absent an adequacy decision, Article 48 lets a transfer proceed on appropriate safeguards such as a legally binding instrument between public authorities, binding business rules under Article 49, an approved code of conduct or certification mechanism, or standard contractual clauses the Agency adopts, some subject to the Agency's prior approval.

Article 50 bars recognizing or carrying out a foreign court judgment or administrative decision that would require a transfer or disclosure of personal data unless it rests on an international agreement such as a mutual-legal-assistance treaty between the requesting country and Bosnia and Herzegovina.

Article 51 permits a transfer absent an adequacy decision or appropriate safeguards only on a listed derogation, such as the person's informed explicit consent, contractual necessity, an essential public interest, or a legal claim, and bars relying on the narrower residual derogation in Article 51(2) for a transfer that is repetitive or systematic.

Articles 91 to 95 restate the same adequacy, safeguards and derogation structure for a competent authority transferring personal data for the prevention, investigation, detection or prosecution of a criminal offence, adding that the transferring authority must weigh the seriousness of the offence and the destination's level of protection before authorizing an onward transfer, and that a transfer of data originally received from another country needs that country's prior authorisation except where an immediate and serious threat to public security makes obtaining it impossible in time.