Law note · North Macedonia
Law on Personal Data Protection (LPDP)
The LPDP transposes General Data Protection Regulation (GDPR) structure and principles per the Agency's own guidance and CMS commentary, though the lawful-basis and controller and processor articles were not independently confirmed against primary text in this pass.
Primary text confirms biometric data as a special category under a functional, GDPR Article 4(14)-style definition with no enumerated examples such as face or voice, and confirms Article 84's prior-approval regime: processing of health data, genetic data, or biometric data requires the Agency's approval before it may occur at all, including where the processing rests on the data subject's own explicit consent under Article 84(2).
Primary text also confirms a cross-border transfer regime using third-country, international-organisation, binding-corporate-rule, and adequacy-adjacent safeguard language across Articles 50, 51 and 53, and a civil damages right under Article 101 that a citizen association may also bring on a data subject's mandate under Article 100.
The 2021 amendment's own content, a further amendment reported as OG 101/25, publicly-available-data treatment, and breach notification were not confirmed in this research.
What it asks of an app
- Establish a lawful basis and allocate controller and processor duties before processing personal data of a person in North Macedonia.
- Obtain the Agency's prior approval before processing health data, genetic data, or biometric data of a person in North Macedonia under Article 84, even where the processing rests on the data subject's own explicit consent.
- Rely on an adequacy determination, standard contractual clauses, binding corporate rules, or an approved code of conduct before transferring personal data of a person in North Macedonia outside the country.
- Expect a person in North Macedonia, or a citizen association acting on their mandate, to have a civil damages claim under Article 101 for an infringement of this law.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics