KosovoLaw No. 06/L-082 on Protection of Personal Data, transfer of personal data to other states and international organisations
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 12 March 2019.
A cross border transfer rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Before transferring personal data to another state or an international organisation, confirm the destination is on the Agency's adequacy list, or ensure the transfer meets one of Article 49's other bases, such as the data subject's informed consent or the controller's own adequate safeguards.
- Where you rely on Article 49, keep a record of the transfer authorisation as part of your Article 29 processing register.
- Do not disclose or transfer personal data in response to a foreign court judgment or administrative decision unless an international agreement between that state and Kosovo authorises recognition or enforcement of the request.
- Expect the Agency's adequacy assessment to weigh the destination's rule of law and human rights record, the existence of an effective independent supervisory authority, its international commitments, and whether data subjects there have effective, enforceable rights and redress.
- Expect the Agency to review its adequacy list at least every four years, and to amend or suspend a listing without retroactive effect if a state or organisation stops ensuring an adequate level of protection.
What it reaches
Obligation class
Transfer, Access restriction
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 44 permits transferring personal data to another state or an international organisation only in accordance with this law and only where that state or organisation ensures an adequate level of data protection.
Articles 45 and 46 let the Agency formally decide that a state or international organisation, or a specified sector within it, ensures an adequate level of protection, maintain a public list of those states and organisations, and adopt a decision the competent European Union body has already made to the same effect.
Article 47 lists the factors the Agency weighs in an adequacy decision, including the rule of law and human rights record, the existence of an effective independent supervisory authority, the third state's or organisation's international commitments, and the data subject's effective and enforceable rights and administrative and judicial redress. Article 47(3) requires the Agency to review its adequacy list at least every four years.
Article 49 lets the Agency authorise a transfer to a state or organisation that does not ensure an adequate level of protection where one of the listed conditions is met, including another law or binding international treaty, the data subject's informed consent, necessity for performing or entering a contract, an important public interest, protecting the data subject's life or body, legal claims, a public register open to consultation, or the controller's application of adequate safeguards.
Article 50 requires the Agency's transfer authorisations to be recorded under Article 29(1)(5)'s processing-register rule. Article 51 lets a foreign court judgment or administrative authority decision demanding a controller or processor transfer or disclose personal data be recognised or enforced only on the basis of an international agreement between the requesting third state and the Republic of Kosovo.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometrics
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.