For nine weeks, we have explained what personal data are, the rights of data subjects, the responsibilities of controllers and processors, the role of the Data Protection Officer, and the fines and sanctions imposed by the Information and Privacy Agency (IPA). This week, the tenth and concluding week of our series on personal data protection…
The Data Protection Officer (DPO) is a key figure in the implementation of the Law on Personal Data Protection in Kosovo. The appointment of a DPO does not depend solely on the size of the organization, but on the nature and intensity of the processing of personal data, especially when it involves sensitive or large-scale…
In order for data controllers to lawfully process personal data, as required by the core principle of personal data protection, such processing must be based on a legal basis. The Law on Personal Data Protection (LPDP) defines six legal bases for the processing of non-sensitive personal data, while it provides a separate list of ten…
The core principles of personal data protection form the foundation of all processes involving the collection, processing, and management of personal data. Article 4 of the Law on Personal Data Protection (Law No. 06/L-082) sets out several fundamental principles that directly and indirectly impact all other rules and obligations set by the law. For any…
Personal data and its protection have become topics of high importance for every individual, business, or institution. However, what is equally important in this context is understanding: What qualifies as personal data? Do all personal data enjoy the same level of protection? Who bears the responsibility for collecting, processing, and safeguarding this data? Below, we…
This article is the first in a series dedicated to personal protection in Kosovo. In this introductory part, we provide a historical and institutional overview to better understand the foundation upon which this system has been build. Personal Data Protection in Kosovo Over the Years Until 2010, Kosovo did not have a specific law regulating…
The Information and Privacy Agency of Kosovo, through Decision No. 22/2025 dated 30 April 2025, approved the list of countries and international organizations providing an adequate level of personal data protection. As is well known, the Law on Personal Data Protection provides that the transfer of personal data outside the Republic of Kosovo is permitted…
At a time when digital technology has revolutionized the way information flows across national borders, the sharing of personal data has become an inevitable and increasingly important process. As the personal data of Kosovo citizens travels across global platforms, the main challenge is ensuring the security and privacy of this information. But how can we…