Align your business with the new law

The BiH Personal Data Protection Law (Official Gazette BiH, No. 12/2025) is a new legal framework regulating the collection, processing, and protection of personal data in Bosnia and Herzegovina. The law is aligned with EU GDPR regulations and applies to all organizations processing personal data of BiH citizens.

All organizations that collect or process personal data — private companies, public institutions, non-profits, sole traders, and freelancers. Regardless of organization size, if you process personal data of employees, clients, or users, you are required to comply.

A GAP analysis is an initial assessment that identifies differences between the current state of data protection in your organization and legal requirements. This is the first step toward compliance — without a GAP analysis, you cannot know which measures to take and how much work is needed for full compliance.

A DPO is mandatory for public authorities, organizations whose core activities involve regular and systematic monitoring of individuals on a large scale, and organizations processing special categories of data on a large scale. Even if not legally required, appointing a DPO is recommended practice. We offer external DPO services as a practical and cost-effective solution.

A DPIA (Data Protection Impact Assessment) is a mandatory risk analysis that must be conducted before initiating processing operations that may result in high risk to the rights and freedoms of individuals. This includes using new technologies, profiling, processing special categories of data, or systematic monitoring of publicly accessible areas.

The law provides for significant financial penalties for organizations that fail to meet their data protection obligations. Beyond financial penalties, organizations also face reputational risk, loss of client trust, and potential lawsuits from individuals whose rights have been violated.

The duration depends on organization size, data processing complexity, and current compliance status. For smaller organizations, basic measures can be implemented in 4-6 weeks. For medium and larger organizations, full compliance may take 2-4 months. ProAct Consulting offers three packages tailored to different levels of need.

At minimum, you need: a privacy policy, record of processing activities, procedures for exercising data subject rights, incident response plan, consent forms, data processing agreements with third parties, and internal data protection policies and procedures. ProAct Consulting creates complete documentation tailored to your organization.