Data Privacy Laws in Bosnia and Herzegovina: What Retailers Need to Know?

Bosnia and Herzegovina’s data protection framework strictly limits the collection and processing of personal data such as the Unique Citizen Number (JMB) to legally authorized controllers, with rules applying nationwide across both entities. For retailers, this means fiscal and POS systems must not collect or process JMB or other personal data without a clear legal basis, as non-compliance can lead to penalties and complaints to the state-level data protection authority.

The protection of personal data has become a critical concern across all industries. Bosnia and Herzegovina has established clear legal frameworks to regulate how personal information, including the Unique Citizen Number (JMB), can be collected and processed.

The regulations regarding the processing of personal data, specifically the Unique Citizen Number (JMB), primarily belong to the domain of data protection laws in Bosnia and Herzegovina. These laws strictly limit who can collect and process personal data from ID cards, allowing only authorized controllers under explicit legal provisions to do so. While primarily aimed at protecting citizens' privacy, these rules indirectly affect other sectors, including retail, which must also be aware of and comply with data protection requirements.

Importantly, these regulations apply to the entire territory of Bosnia and Herzegovina, including both the Republic of Srpska and the Federation of Bosnia and Herzegovina. However, some implementation details may vary depending on entity-level legislation.

Retailers in the Republic of Srpska, for example, generally do not have the legal authority to collect or process personal data such as JMB from customers unless explicitly authorized by law. Fiscal and electronic fiscal devices used in retail are designed mainly for transaction recording and issuing receipts, and they must not collect or process personal data without a clear legal basis. Compliance with these laws is crucial to avoid violations that could result in penalties or complaints filed with the Agency for Personal Data Protection, which operates at the state level. Therefore, even sectors not directly involved in data collection must stay informed about data protection regulations to ensure lawful business practices.

This is especially important, as improper handling or unauthorized processing of personal data can lead to legal consequences and undermine customer trust. Ultimately, protecting personal data in all sectors strengthens overall data privacy and security in Bosnia and Herzegovina. Retailers and other businesses should regularly review their policies and ensure that any processing of personal data complies fully with applicable laws.