Data protection · Montenegro
Data Protection Officer (DPO) in Montenegro — is one mandatory for you?
Montenegro’s new Personal Data Protection Act (Official Gazette 133/26) makes a data protection officer a statutory obligation for part of all organisations, applicable from 19 March 2027. Go through the three statutory cases and see whether you are among them — and if you are, we either take the role or train your own person.
The three cases in which an officer is mandatory
The obligation is judged by activity and scale of processing, not by headcount. A small firm of ten can be caught by it while a company of two hundred is not.
Public authorities
All bodies and public institutions, regardless of the scale of processing. The only exception is courts acting in their judicial capacity. Municipalities, ministries, agencies, public institutions, schools, hospitals and public enterprises fall into this group.
Large-scale monitoring of people
Where the core activity consists of regular and systematic monitoring of individuals on a large scale. In practice: security firms and surveillance as a service, telecommunications, vehicle tracking, platforms that profile users, behavioural advertising.
Special categories at scale
Where the core activities involve large-scale processing of special categories of data — health, biometrics, genetic data, religious or political beliefs, trade union membership, sex life (Article 10) — and of data on criminal convictions (Article 11). In practice each of the two is assessed on its own, so the obligation arises even where only one is present. Typically hospitals and clinics, laboratories, insurers and recruitment agencies.
What "large scale" means
The act gives no number. In practice you look at the number of data subjects, the volume and type of data, the duration of processing and its geographical reach. A two-room surgery and a clinical centre are not the same thing even though both process health data. The obligation therefore cannot be settled in one sentence — but it can be assessed reliably enough through a handful of questions.
Does your organisation need a data protection officer?
First we establish whether an officer is mandatory for you under Article 38 — the result is a clear finding, not a percentage. Then come questions on the officer’s position and independence, their tasks, and the documentation without which they cannot work. At the end you get a score by area and a list of what you are missing.
The check gives an indicative finding and is not legal advice. Compliance is assessed in supervision by the Agency for Personal Data Protection and Free Access to Information.
What the officer does
The tasks are set by statute — the officer is not "someone from IT who answers emails about data", but a role with defined duties and a protected position.
Monitors compliance
Monitors the application of the act and of internal data protection rules, including the allocation of responsibilities, training and audits. This is continuous work, not a one-off review.
Advises and trains
Advises the controller and staff on their obligations and trains the people who work with data — HR, sales, front desk, IT, marketing.
Opinion on the impact assessment
Gives an opinion on the data protection impact assessment and monitors its implementation wherever processing is high risk.
Point of contact
Towards the Agency — for prior consultation and any other matter; and towards individuals — for exercising their rights and all questions about the processing of their data.
Reports to top management
Not to a department head but directly to the top of the organisation. That is the mechanism that gives the role real weight.
Independence and conflict of interest — the most common mistake
The officer must not receive instructions on how to carry out their tasks, nor suffer any detriment for carrying them out. They must not be in a conflict of interest, which means they cannot be a person who determines the purposes and means of processing. In practice the organisations that get this wrong are the ones that appoint the director or the head of IT, HR or legal — precisely the people who decide what is processed and how. This is why the role is often placed outside the organisation. The officer’s contact details are published and submitted to the Agency.
How we do it
There are two options and both are legitimate — it depends on whether you have someone to appoint and how much processing there really is. Click a service and it will be ticked in the form at the bottom of the page.
External data protection officer
We take the DPO role under contract: monitoring compliance, advising management, acting as the point of contact towards the Agency and towards individuals, opinions on impact assessments and an annual report. The answer for organisations for which an officer is mandatory but who have nobody to appoint without a conflict of interest.
Request a quote Option 2Training an in-house officer
Training your employee for the role — the act, data subject rights, records, impact assessment, breach handling — together with the procedures and templates they will use afterwards on their own. It includes a check of whether their position in the organisation satisfies the independence conditions.
Request a quote Article 31Records of processing activities
An inventory of all processing with purposes, categories of data subjects and data, recipients, retention periods and security measures. This is the document that replaced filing registers with the Agency and the first thing supervision asks for.
Request a quote Article 36Impact assessment (DPIA)
Wherever processing is likely to be high risk — large-scale surveillance, profiling, processing of special categories. Assessment, mitigating measures and, where required, prior consultation with the Agency.
Request a quote Articles 34–35Breach procedure
Who establishes a breach, who notifies the Agency within 72 hours, when the individuals themselves are informed and what gets recorded — with templates and an internal breach register.
Request a quote Article 29Processor contracts
Review and alignment of contracts with everyone who sees data on your behalf: IT support and hosting, accounting, archiving and document destruction, surveillance, payment processing.
Request a quote PreparationGap analysis against the act
A review of where you stand against every obligation in the act, with a list of gaps, priorities and a realistic timeline to 19 March 2027.
Request a quote SystemISO/IEC 27701 as the framework
If you want data protection to be a system that is audited rather than a pile of documents — ISO/IEC 27701 extends ISO/IEC 27001 with privacy information management and gives you a structure that tenders and partners recognise.
Request a quoteFrequently asked questions
From when must we have an officer?
The act applies from 19 March 2027. Until then the 2008 act remains in force. Appointment is the easy part, though — the work the officer inherits, above all the inventory of all processing in the organisation, takes months, so preparation starts earlier.
Can the director be the data protection officer?
It is not formally prohibited, but as a rule it is a conflict of interest. The officer must not be a person who determines the purposes and means of processing, and that is precisely what a director does. The head of IT, HR or legal has the same problem. Supervision reads this as a nominal rather than a genuine appointment.
Can the officer be someone outside the organisation?
Yes. The act allows the officer to be an employee or a person performing the tasks under a service contract. An external officer is the most common solution here, especially for organisations where every internal appointment leads to a conflict of interest.
We have fewer than 250 employees — does this concern us?
Headcount is not the criterion for the obligation to appear an officer — that figure appears in connection with records of processing activities, and even there with exceptions. The officer obligation is judged by whether you are a public authority, whether your core activity is large-scale monitoring of people, and whether you process special categories of data on a large scale.
Can several related companies share one officer?
They can, provided the officer is easily accessible from each of them. The same applies to several public authorities, taking into account their organisational structure and size.
Is the officer liable if a data breach occurs?
No. The controller — the organisation itself — is liable for compliance and for damage. The officer advises, monitors and warns, and that is exactly why there must be a record of what was advised and what was flagged. Their protection from detriment for performing the role is expressly provided for.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Request a quote for a data protection officer
Tell us what you do and how many people handle personal data — we will tell you whether an officer is mandatory for you and which is cheaper in your case: an external DPO or training your own employee. Call us or send an enquiry — we reply within 24 hours.