Enforcement under the DP Law emphasizes the Agency’s strongest powers while also promoting proactive compliance, risk mitigation, and accountability.

Key enforcement powers:

• The Agency can impose fines of up to BAM 40 million, or up to 4% of the organization’s total annual global turnover if this amount exceeds the fixed maximum fine.
• It may suspend or permanently prohibit processing of personal data.
• It can order the correction, deletion, or destruction of personal data, and mandate remedial actions to prevent future violations.
• The Agency may issue warnings, reprimands, or orders for compliance, and initiate administrative or misdemeanor proceedings.
• Risk-based supervision: The Agency prioritizes enforcement efforts based on the potential risk to data subjects’ rights and freedoms, focusing on high-risk processing activities such as large-scale or sensitive data processing.
• Compliance support: Enforcement is not purely punitive; the Agency provides guidance, recommendations, and advisory support to controllers and processors to ensure proper compliance.
• Cooperation and coordination: The Agency works with other national authorities and international supervisory bodies, ensuring consistent enforcement, especially for cross-border data transfers and multinational organizations.
• Transparency and accountability: Enforcement is accompanied by public reporting, including annual reports to the Parliamentary Assembly, covering enforcement actions, trends, and recommendations for improving compliance nationwide.
• Internal accountability and breach management: Controllers and processors must implement internal mechanisms for monitoring and managing compliance, maintain records, conduct audits, support their Data Protection Officers, and have systems to detect, report, and remediate data breaches.

Additional rights and penalties:

• Data subjects have the right to seek compensation when their rights under the DP Law are violated.
• Criminal liability exists under the criminal codes of BiH, FBiH, RS, and BD, for unlawful processing of personal data, punishable by fines or imprisonment of up to 6 months (BiH/FBiH) or up to 1 year (RS/BD).