KosovoLaw No. 06/L-082 on Protection of Personal Data, special categories, children and criminal-offence data
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 12 March 2019.
A sensitive categories rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 8(2) exception applies, most commonly the data subject's explicit consent.
- Where you rely on an Article 8(2) exception, protect special categories of personal data with heightened, classified safeguards against unauthorised access and use.
- Confine any processing of personal data about a person's criminal convictions or offences, or related security measures, to what an official authority controls under the relevant law.
- Treat sixteen as the age at which a child may consent to an information-society service directly, and obtain or verify consent or authorisation from a parent or holder of parental responsibility below that age, making reasonable and ongoing efforts, using available technology, to confirm that consent when the child is between fourteen and sixteen.
- Treat an identifier your system derives from a photograph or video of a person in Kosovo, such as a faceprint, as covered biometric data under Article 3(1)(20); the definition names visual images and fingerprint, iris, retina, facial-feature and DNA data as examples and excludes nothing that is recording-derived.
What it reaches
Excludes recording-derived identifiersNo
Obligation class
Prohibition, Consent, Biometric, Age verification
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 8(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning sex life or sexual orientation.
Article 8(2) lifts that prohibition only under the listed conditions, running from the data subject's explicit consent through employment, social security and social protection law, vital interests, the legitimate activities of a non-profit body processing only its own members' data, data manifestly made public by the data subject, legal claims, substantial public interest, preventive or occupational medicine, public health, and archiving, scientific, historical or statistical purposes.
Article 8(4) requires special categories of personal data to be given heightened protection and to be classified to prevent unauthorised access and use. Article 3, paragraph 1, item 25 separately defines sensitive personal data to include ethnic or racial origin, political or philosophical views, religious affiliation, trade union membership, health data, sex life data, and any entry in or removal from a criminal or misdemeanour record.
The same item adds that biometric characteristics also count as sensitive personal data where they enable identifying a data subject in relation to any of those circumstances.
Article 3, paragraph 1, item 20 defines biometric data as all personal data resulting from specific processing relating to the physical, psychological or behavioural characteristics of a natural person that allows or confirms that person's unique identification, naming visual images and fingerprint, iris, retina, facial-feature and DNA data as examples.
Article 9 confines processing of personal data concerning criminal convictions and criminal offences, or related security measures, to the control of an official authority under the relevant law, and keeps any comprehensive register of criminal convictions solely under an official authority's control.
Article 7 sets the threshold for a child's own consent to an information-society service at sixteen years, and requires the controller to make reasonable efforts, using available technology, to verify that consent was given or authorised by the holder of parental responsibility below that age.
A separate paragraph directs continuing efforts to verify parental or guardian consent specifically between fourteen and sixteen years, without stating how that duty relates to the sixteen-year threshold the same article sets.
When LexLint raises it
serves_minorshandles_health_recordsprocesses_biometrics
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.