News — Regulations & Deadlines

New Law on Personal Data Protection adopted — fines up to €2 million, breach notification within 72 hours

The Government adopted the bill in August, and in early September 2026 Parliament passed Montenegro's new Law on Personal Data Protection, aligned with the GDPR, together with a separate law on data processed by competent authorities for the prevention and prosecution of criminal offences. The law brings an entirely new legal framework, replacing the previous law as amended in 2024.

What changes for companies and institutions

• Fines of up to €2,000,000 or up to 4% of total worldwide annual turnover for the most serious infringements (processing principles, individuals' rights, unlawful transfers abroad); up to €1,000,000 or 2% of turnover for other infringements.
• A personal data breach must be reported to the supervisory authority within 72 hours at the latest, and affected individuals must be informed where there is a high risk. Every breach must be documented.
• Data protection impact assessment (DPIA) for high-risk processing: large-scale profiling, automated decision-making, special categories of data, systematic monitoring of public spaces.
• The data protection officer must be involved in good time, takes no instructions and may not be penalised for performing their tasks.
• Broader rights for individuals: access, rectification, erasure (the "right to be forgotten"), restriction of processing, portability and objection. Consent must be as easy to withdraw as to give, and parental consent is required for children under 16.

Supervision is carried out by the Agency, based in Podgorica. Other regulations governing the processing of personal data must be aligned with the new law by 1 December 2026. Amounts and deadlines are as set out in the bill the Government sent to Parliament.

New Food Safety Law — stricter traceability

The Food Safety Law (Official Gazette of Montenegro, No. 59/2026) introduced stricter "one step forward — one step back" traceability rules across the entire food chain — from raw material to end consumer — with fines for violators of up to €20,000. The obligation to establish procedures based on HACCP principles remains the foundation of compliance for every food-business operator.

Amendments to the Energy Law and a ban on subsidies for fossil-fuel boilers

The Energy Law was amended in the Official Gazette of Montenegro Nos. 28/2025 and 3/2026. As part of aligning with EU directives on the energy performance of buildings, Montenegro has a deadline of June 2026 to legally ban subsidies for fossil-fuel boilers, while all new publicly owned buildings must be designed as zero-emission from 1 January 2028.

Law on Information Security (NIS2) — ISO 27001 becomes mandatory for some entities

The Law on Information Security (Official Gazette of Montenegro, No. 113/2024) has been in force since 5 December 2024 and aligns Montenegro with the EU's NIS2 directive — one of the first Western Balkans countries to do so. It introduces the categories of "key" and "important entities" (state bodies, critical-infrastructure operators, companies from sensitive sectors). Key entities must obtain a MEST ISO/IEC 27001 certificate within 30 months — by June 2027 at the latest — while important entities apply the prescribed security measures without a mandatory certificate.

Amendments to the Law on Occupational Safety and Health

Amendments to the regulations on inspection oversight in occupational safety and health were published in the Official Gazette of Montenegro No. 084/24 of 6 September 2024, and apply from 1 October 2024. Inspection oversight of employers has been tightened — an additional reason for your occupational health and safety system to be documented and up to date.

The first Law on the Use of Energy from Renewable Sources

On 17 August 2024 the Parliament of Montenegro adopted the first law of its kind (Official Gazette of Montenegro 082/24), in force since 31 August 2024. The law lays the groundwork for encouraging investment in renewable energy sources, with an emphasis on reducing CO2 emissions — relevant for any organisation introducing an energy management system.