Personal data protection for Kosovo businesses

Every business collects personal data, even when it doesn't think so: customer lists, phone numbers on WhatsApp, employee files, cameras on the premises, forms on the website. The Law on Personal Data Protection, drafted in the spirit of the European GDPR, sets rules on how you can use them.

What personal data is#

Any information that identifies a person: name, personal number, phone, email, address, photo, camera footage, bank account number, IP address.

Some is sensitive data with stronger protection: health, religion, ethnic origin, political opinions, trade union membership, biometric data.

Core principles#

1. A legal basis. Use data only when you have a lawful reason: a contract with the person, a legal obligation, consent or a legitimate interest that doesn't override their privacy.
2. A specific purpose. Data collected for an invoice isn't used for marketing without another basis.
3. Minimisation. Collect only what you need.
4. Accuracy. Keep it up to date.
5. Storage limits. Don't keep it longer than needed.
6. Security. Protect it from unauthorised access, loss or leaks.

Employee data#

• Keep only the documents you need for the employment relationship. See Hiring your first employee.
• Medical certificates are sensitive data: store them separately with restricted access. See Sick leave.
• Monitoring work email or computers is allowed only with clear rules, announced in advance.
• Add a confidentiality clause to employment contracts. See The employment contract.

Cameras on the premises#

Cameras are one of the most common sources of complaints. The basic rules:

• a visible notice at the entrance that the area is monitored;
• no cameras in toilets, changing rooms or break rooms;
• don't film public space beyond what security needs;
• access to recordings only for authorised people;
• delete recordings after a short period, unless needed for an incident.

Customers and marketing#

• Don't send marketing messages without the customer's consent or a prior relationship the law allows.
• Offer a simple way to unsubscribe.
• Your website needs a privacy policy explaining what you collect and why.
• Be careful with customer photos on social media: ask permission.

People's rights#

Everyone has the right to:

• know what data you hold about them;
• correct it;
• ask for deletion when there's no longer a basis to keep it;
• object to marketing;
• complain to the Information and Privacy Agency (IPA, locally AIP).

Answer requests within the legal deadline.

Security and data breaches#

• Strong passwords and need-to-know access.
• Regular backups.
• Wiping data from old devices before selling or discarding them.
• Contracts with suppliers who process data for you, such as your accountant or software provider.

If a breach puts people at risk, the law requires you to notify the IPA and, in some cases, the people themselves.

Public business data#

The law protects natural persons, not official information about businesses. A business's name, NUI, status, business address and authorised persons are public register data, because company law requires them to be transparent. That's also how open data works on Kerko, where the data sources are listed on the sources page.