Material Applicability

The Personal Data Protection Law (PDPL) of Montenegro defines its material scope through several key factors:

• Automated and manual processing
• Filing system requirements
• Personal and domestic use exemption
• National security and defense exemption

Automated Processing and Filing Systems

PDPL Art.7:

"This law applies to the processing of personal data that is carried out automatically, in whole or in part, or by any other means, and is an integral part of or will become part of a collection of personal data."

The law covers both automated and manual processing, provided the data:

• Is processed wholly or partially by automated means, or
• Forms part or is intended to form part of a filing system

Exemptions

PDPL Art.8(1):

"This law, except for provisions on supervision, does not apply to the processing of personal data for the purposes of defense and national security, unless otherwise provided by special law."

PDPL Art.8(2):

"This law does not apply to individuals when they process personal data for their own needs."

Two primary exemptions limit the law's scope:

• Defense and national security processing (with supervision provisions remaining applicable)
• Personal data processing by individuals for their own needs

Territorial Applicability

The PDPL's territorial scope is determined by:

• Processing within Montenegro
• Use of equipment within Montenegro
• International law considerations

PDPL Art.5(1):

"According to this law, data controllers who process personal data within the territory of Montenegro or outside Montenegro where Montenegro's regulations apply in accordance with international law are obligated to act."

PDPL Art.5(2):

"This law also applies to data controllers who are established outside Montenegro or do not have a residence in Montenegro, if the equipment for processing personal data is located in Montenegro, except if that equipment is only used for transmitting personal data across the territory of Montenegro."

The territorial scope encompasses:

• Processing activities within Montenegro
• Processing by controllers using equipment located in Montenegro, except for mere data transit
• Processing outside Montenegro where Montenegrin law applies under international law