The Ministry of Justice of North Macedonia has published draft amendments to the Law on Personal Data Protection on the ENER platform, opening a public consultation period until mid-March. The proposal introduces several important updates, most notably the first explicit references to artificial intelligence (AI) within the Macedonian data protection framework, alongside changes affecting international data transfers and controller obligations.
A key novelty is the regulation of personal data processing in the context of developing and operating AI systems. The draft recognises that such processing may rely on legitimate interest as a legal basis, provided that the rights and freedoms of data subjects are not overridden, and appropriate organisational and technical safeguards are implemented. In addition, controllers are expected to apply strict data-minimisation measures during AI training and testing and to prevent the use of special categories of personal data, by removing or effectively protecting such data if detected.
The amendments also introduce structural changes to international transfers of personal data. Notably, they remove references to transfers to NATO member states under the exception that previously allowed such transfers to be carried out based solely on notification to the data protection authority (as is the case for transfers to EU/EEA member states). If adopted, transfers to NATO member states that are not part of the EU/EEA will once again be treated as transfers to third countries, and therefore be subject to applicable safeguards and requirements governing such transfers.
Beyond AI and cross-border transfers, the draft strengthens compliance obligations by introducing requirements such as maintaining records of authorised access in certain automated processing environments and responding within specific deadlines to requests from the Agency for Personal Data Protection of North Macedonia.
If adopted, the amendments will have practical implications for organisations using advanced technologies or transferring data internationally. The consultation phase, therefore, presents an important opportunity for businesses and practitioners to provide feedback before the final legislative text is adopted.
The information in this document does not constitute legal advice on any particular matter and is provided for general informational purposes only.
