GDPR consulting helps companies map personal data, define legal bases, manage contracts, rights, incidents and transfers under Montenegro’s new law and EU GDPR.
Request a GDPR assessment
GDPR compliance defines how an organisation collects, uses, stores, shares and protects personal data. ConsultHQ helps companies prepare for Montenegro’s Personal Data Protection Law 133/2026 and align processing with the EU GDPR where it directly applies to their business.
The law was published on 11 September 2026 and entered into force on 19 September 2026. It will apply from 19 March 2027, giving organisations a transition period to establish processes, documentation, contracts and training.
Official Gazette of Montenegro No. 133/2026A privacy policy alone does not make a company compliant.
Problems usually arise when an organisation cannot clearly demonstrate which personal data it processes, why it uses that data, who can access it, how long it retains it and which partners receive it.
Montenegro’s new law and the EU GDPR require demonstrable accountability. The purpose of an engagement is to connect legal requirements with the actual work of HR, sales, marketing, IT, finance and management, alongside preparing documentation.
Montenegro’s new Personal Data Protection Law was published in Official Gazette No. 133/2026. It entered into force on 19 September 2026 and will apply from 19 March 2027.
The transition period gives companies time to review existing processing, assign responsibilities and implement controls before the new regime becomes applicable.
Preparation requires more than updating a single privacy policy. Companies need to review processes, databases, supplier contracts, retention periods, data subject rights, video surveillance, incidents and other processing relevant to their business.
The EU GDPR may directly cover certain processing by a company established outside the European Union.
This may be relevant when a company specifically offers goods or services to people in the EU or EEA, monitors their behaviour, or processes data for a European client under arrangements that create GDPR obligations.
Applicability is assessed for the specific processing, rather than solely by the company’s place of registration.
A website being accessible in the EU or an occasional client does not automatically determine the outcome. The assessment must consider the targeted market, how the service is delivered, contractual relationships and data flows.
The project scope depends on the business sector, the volume and sensitivity of personal data, the number of systems and suppliers, and the markets in which the company operates.
We start by reviewing the current situation, rather than drafting a universal documentation package.
We examine how the company collects personal data, which systems it uses, who has access, which suppliers receive data and how it handles data subject requests and incidents.
The result is a prioritised action plan.
We distinguish more serious gaps from administrative improvements so the company can first address processing that creates the greatest legal, security or business risk.
A company cannot effectively manage personal data it has not identified.
Mapping covers employees, applicants, customers, users, guests, business contacts and other data subjects according to the organisation’s actual processes.
For each relevant processing activity, we identify its purpose, legal basis, data categories, recipients, systems, retention period and responsible functions.
This turns records of processing activities into a management tool, rather than a spreadsheet opened only before an inspection.
Companies do not all need the same number of policies and procedures.
Depending on the business, documentation may include records of processing activities, privacy notices, a retention schedule, procedures for data subject rights and personal data breaches, processor contracts, legitimate interest assessments and DPIA documentation.
We first review existing contracts, internal rules and IT procedures.
We introduce new documents where there is a specific need, rather than to make the GDPR file look more substantial.
Cloud platforms, hosting providers, CRM systems, accounting, payroll, marketing tools and IT support may process personal data on the company’s behalf.
Signing a generic contract and assuming the risk has moved to the supplier is insufficient.
The review must establish the partner’s role, scope of processing, sub-processors, security measures, data locations, incident reporting arrangements and what happens when the contract ends.
Controls should reflect the actual risk of the service.
Adoption of Montenegro’s new law does not automatically constitute a European Commission adequacy decision.
Montenegro is currently not on the list of jurisdictions recognised by the European Commission as providing an adequate level of protection under Article 45 of the GDPR.
When a European client or partner transfers personal data to a company in Montenegro, an appropriate mechanism under Chapter V of the GDPR may be required.
This may involve Standard Contractual Clauses, a transfer assessment and additional technical or organisational measures.
The review also covers cloud suppliers, remote access, sub-processors and onward transfers.
Adequacy status and the required mechanism should be checked for each specific transfer.
A request for access, rectification, erasure, restriction or objection should not depend on who opens the email that day.
The company needs to know who receives the request, how identity is verified, where to locate the data, who makes the decision and how the response is documented.
Data subject rights frequently involve several systems and departments.
The procedure should therefore connect the legal deadline with the organisation’s actual working arrangements.
A lost device, misdirected email, unauthorised access, ransomware or a publicly accessible document may constitute a personal data breach.
The company should define reporting channels, risk assessment, responsibilities and decision records in advance.
Where the EU GDPR applies, certain breaches require notification to the competent authority without undue delay and no later than 72 hours after becoming aware of the breach.
Where processing is likely to create a high risk, a data protection impact assessment should be conducted before processing begins or undergoes a significant change.
Appointment of a Data Protection Officer should be based on legal criteria and the actual scope of processing.
A company should not appoint a DPO simply to display a contact address on its website.
Where appointment is required, the role must have appropriate expertise, independence, resources and access to management.
For companies subject to the territorial scope of the EU GDPR, any requirement to appoint an EU representative is assessed separately.
Within this service, ConsultHQ assesses the need and helps organise the function. The engagement does not automatically appoint ConsultHQ as a DPO or EU representative.
The engagement should deliver a system employees can apply and maintain.
ConsultHQ helps the company understand requirements, identify gaps and implement documented controls.
We do not issue official GDPR certificates, act as a supervisory authority or guarantee the outcome of regulatory proceedings.
Where the project requires a formal legal opinion, representation or a specialist technical assessment, an appropriate legal or technical professional should be involved.
Our role is to translate requirements into processes, responsibilities, documentation and training that the company can use in its everyday work.
A practical challenge in a GDPR project is that personal data is spread across several departments.
HR, sales, marketing, IT, finance and management often use different systems and suppliers.
We therefore organise implementation in phases and by priority.
The company first addresses higher risk processing, then systematically establishes the remaining documentation and controls.
Companies in Montenegro now have a concrete preparation deadline before the new law begins to apply on 19 March 2027.
An initial GDPR gap analysis by ConsultHQ can identify which processing activities and documents already meet the requirements, where actual gaps remain and the order in which to address them.
An initial assessment helps us define scope and next steps based on your actual business.
Request a GDPR assessment