The Personal Data Protection Law applies to any situation involving the processing of citizens’ personal data, regardless of whether the natural or legal person performing the processing is from the private, state, or civil sector. It is guided by the principle of guaranteeing the privacy and personal integrity of individuals.
State and public institutions are required to apply these personal data protection regulations, whether the processing of personal data is conducted in paper or electronic form. State and public institutions include all state and local government bodies and other state entities, as well as institutions operating in the fields of education, science, health, culture, labor, social protection and child protection, sports, and other activities of public interest established by law. This includes agencies, funds, public institutions, and public enterprises established by the Republic of North Macedonia, municipalities, the City of Skopje, and municipalities within the City of Skopje.
The law provides guidelines to ensure that the personal data of natural persons is processed only to the necessary extent, avoiding the collection of excessive data. Furthermore, natural persons have the right to know who is processing their personal data, for what purpose, which data is being processed, how long it is stored, and other relevant details. The law also requires that data be stored only for the period necessary to achieve its purpose and that it must be destroyed afterward. Every legal or natural person collecting personal data must take appropriate technical and organizational measures to protect the data using the most modern tools available.
Taking this into account, the NGO Info-centre, in partnership with the organizations Spektar from Kriva Palanka, the Civic Initiative of Women from Sveti Nikole, the Women’s Organization from Strumica, and Aktivo from Veles, conducted monitoring of the implementation of the Personal Data Protection Law at the local level during the period June–September 2024. The purpose of the monitoring was to assess whether municipalities had established the basic documents and policies for personal data protection, in accordance with the law. The monitoring covered six municipalities: Kumanovo, Veles, Strumica, Kriva Palanka, Sveti Nikole, and Lozovo.
The monitoring was conducted within the framework of the project “Active Citizens and Participatory Democracy at the Local Level,” financially supported by the Olof Palme International Center from Sweden.
Key Findings
The monitoring revealed that the implementation of the Law on Personal Data Protection at the local level—specifically regarding the existence of basic policies and procedures such as the appointment of personal data protection officers, policies for establishing a personal data protection system, privacy policies, and cookie policies on official websites—is slow and inconsistent.
- All municipalities have appointed personal data protection officers, but only two (Kumanovo and Kriva Palanka) have published their names and contact information on their municipal websites.
- No municipality has published a privacy policy on its website. The Municipality of Veles includes a link to a privacy policy, but it contains only a short, general statement assuring that data will not be misused.
- Four municipalities (Kumanovo, Veles, Strumica, and Kriva Palanka) have adopted policies for establishing a personal data protection system.
- Two municipalities (Sveti Nikole and Lozovo) lack any other policies or procedures for the protection of personal data, aside from appointing personal data protection officers.
- The situation is similar in public enterprises and institutions under the jurisdiction of the municipalities. Many of these entities do not have policies for the protection of personal data, nor have they appointed personal data protection officers. Additionally, some entities lack their own websites. Among those that do, most have not published policies on privacy, cookie usage, or information about personal data protection officers.
- Website analysis showed that information related to personal data protection is often incomplete, difficult to access, and not easily searchable.
Read the full text of the monitoring Municipalities and Personal Data Protection.
