The 2025 data protection law in Bosnia and Herzegovina for engineers
The law was published in Službeni glasnik BiH No. 12/25 on 28 February 2025, entered into force on 8 March 2025 and has applied since 4 October 2025, after a 210-day period. It is enforced by the Agency for Personal Data Protection in BiH. Fines for legal entities run from 10,000 KM to 20 million KM, or up to 2% of total annual worldwide turnover, for some breaches, and from 20,000 KM to 40 million KM, or up to 4% of total annual worldwide turnover, for the most serious ones, whichever amount is higher. For an existing system, alignment usually starts with finding every place personal data is read or written. Agents trace that across hundreds of files and add tests around it; engineers decide what changes.





