In Montenegro personal data are protected by the Law on Personal Data Protection, and supervision is carried out by the Agency for Personal Data Protection and Free Access to Information. A company, bank, employer or public body processes your data with your consent, which you can withdraw at any time, or without it when the law, a contract, the public interest or its legitimate interest under the law requires it. On a written request the controller must tell you within 15 days whether it processes your data, which data, for what purpose and where it got them, and within the same deadline complete, correct or delete inaccurate and unlawfully processed data. The controller bears the costs of that procedure. If you believe your rights have been breached, you file a request for protection of rights with the Agency, which decides by a decision within 60 days.
This guide explains when your data may be processed, how to request information, correction and erasure, how to refuse direct marketing and how to turn to the Agency.
When may your data be processed?
- A new Law on Personal Data Protection (Official Gazette 133/2026) was published in September 2026 and applies six months after entering into force, from March 2027; until then the rules in this guide apply, and the old law's video surveillance rules stay in force afterwards too, until a separate law is adopted. What the new law changes is explained by RoNa Legal.
- Personal data are processed fairly and lawfully, to no greater extent than the purpose requires, and are kept only as long as needed if the law sets no period.
- Processing is allowed with your prior consent, which you can withdraw at any time.
- Without consent, data are processed when necessary for the controller's legal obligation, to protect your life, to perform a contract you are party to, for the public interest or for the controller's legitimate interest under the law, unless the protection of your rights prevails.
- For a minor, consent is given by the parents or adoptive parents, or a guardian, unless that is against the child's interests.
- Special categories of data, such as data on health, religion or trade union membership, are processed with your explicit consent or in cases the law specifically lists.
- Before your data are used for direct marketing you must be given the chance to object, and for special categories of data your consent is required.
How do you request information about your data?
- You file a written request yourself or through a legal representative or proxy, and the controller first establishes your identity.
- Within 15 days of the request at the latest, the controller answers you in writing and in plain language whether it processes your data.
- If it does, it states its name and address, the content of the data, the purpose and legal basis, the source of the data and the third party it passes them to.
- On explicit request it also names the processor, and for automated processing the way that processing works.
- The controller bears the costs of the procedure on your request, unless the law provides otherwise.
How do you request correction and erasure?
| Request | Deadline and controller's duty |
| completing incomplete data | 15 days from the written request |
| amending or deleting inaccurate data | 15 days from the written request |
| deleting unlawfully processed data | 15 days from the written request |
| notice of the correction or erasure made | eight days, to you and to the third party the data were given to |
- If the controller does not act on the request or refuses it, you can lodge an objection with it under a special law or ask the Agency to protect your rights.
- The rights to information, correction and erasure may be restricted by a special law only as far as necessary, for defence, security, criminal prosecution, economic or financial interests or to protect the rights of others.
How do you turn to the Agency?
- If you believe a right under the law has been breached, you file a request for protection of rights with the Agency, on the form the Agency publishes.
- An Agency inspector carries out an inspection on your request and draws up a report within eight days at the latest, and you and the controller can object to the report within eight days.
- The Agency decides on the request within 60 days, and until then, on your written request, it may temporarily ban further processing if a breach is likely.
- The Agency may order irregularities to be removed, temporarily ban processing and order the erasure of data collected without a legal basis.
- Anyone can also file an initiative to start an inspection, for example on noticing unlawful processing of someone else's data.
- Against the Agency's decision you bring an administrative dispute, and for damage caused by a breach of rights the controller is liable under the general rules on compensation.
- A legal entity that, for example, does not answer a request within 15 days or processes data without a legal basis is fined 500 to 20,000 euros.
Rules for cameras in buildings and around houses are covered in our guide to video surveillance, and misuse of data through fake ads in our guide to online ad scams. How to see your debts with banks is explained in our guide to the credit registry, and asking public bodies for information in our guide to freedom of information.
Frequently asked questions
How do I find out what data a company holds on me? File a written request, and within 15 days the company answers in writing whether it processes your data, which data, for what purpose, where it got them and whom it gives them to.
Can I ask a company to delete my data? Yes, within 15 days the controller deletes inaccurate data and data it processes unlawfully, and you can also withdraw your consent to processing.
Do I pay for a request to see my data? No, the controller bears the costs of the procedure, unless the law provides otherwise.
How do I stop advertising messages? Before direct marketing you must be given the chance to object to processing, and you can withdraw consent to processing at any time.
Whom do I complain to if a company does not answer? To the Agency for Personal Data Protection and Free Access to Information, with a request for protection of rights.
How long does the Agency have to decide? The Agency decides on a request for protection of rights within 60 days of its filing.
Sources
The conditions for processing, consent, special categories of data, direct marketing, the rights to information, correction and erasure, the request for protection of rights, inspection and fines are set by the Law on Personal Data Protection (Official Gazette 79/08, 70/09, 44/12, 22/17 and 77/24, Arts. 2, 3, 9, 10, 13, 15, 43 to 48, 65, 68, 71, 72 and 74), published among the Agency's regulations. The Agency publishes forms for a request for protection of rights and an initiative for inspection on its forms page. The new law, which applies from March 2027, was published in Official Gazette 133/2026 (Arts. 105 and 106). The information was checked on 28 September 2026. Fijaka is a classifieds platform; this text is not legal advice.