Unlike the previous law, the current legal framework in Bosnia and Herzegovina abolishes the central registry previously maintained by the Agency. There is no general obligation to submit records of personal data processing to the Agency. Instead, controllers and, where applicable, their representatives are required to maintain detailed internal records of all processing activities for which they are responsible.

These records should cover:

• the identity and contact details of the controller,
• any joint controllers,
• representatives, or
• data protection officers;
• the purposes of processing;
• categories of data subjects and personal data;
• categories of recipients, including those in other countries or international organizations;
• transfers abroad and related safeguards;
• retention periods; and
• a general description of technical and organizational security measures.

Data processors and their representatives must also maintain records of all processing carried out on behalf of controllers, including information on the type of processing, transfers abroad, and implemented safeguards.

Records must be maintained in written form, including electronic format, and must be made available to the Agency upon request.

Certain exceptions apply: small organizations with fewer than 250 employees are generally exempt, unless the processing is likely to pose a high risk to data subjects’ rights and freedoms, involves non-occasional processing, includes sensitive data, or relates to criminal convictions and offenses.

Specific notification obligations remain in place, such as breach notifications, consultation with the Agency following a data protection impact assessment in high-risk cases, and providing details of the data protection officer, where applicable.