The DP Law and the Rulebook on the Security of Personal Data Processing (Official Gazette of the Republic of North Macedonia no. 266/2024, “Security Rulebook”) apply to online privacy as well. In 2024, the DPA adopted a new Security Rulebook, which began to apply as of 1 July 2025, replacing the previously adopted rulebook. 

Where personal data is processed through websites or online services, the Security Rulebook applies to the security of such processing, provided that these systems form part of the controller’s information system. Controllers are responsible for establishing a functional and sustainable information system in compliance with data protection legislation. This requires preparing and assessing detailed documentation on the intended processing, evaluating lawfulness and risks to data subjects, and implementing appropriate technical and organizational measures to ensure a level of security proportionate to the identified risks.

In this context, the Security Rulebook applies to websites and browser-based environments, among others. In particular, its schedule regarding the purposes of protection, threats and measures, identifies relevant web-related threats and requires controllers to implement appropriate safeguards, including secure transmission protocols (e.g. TLS), certificate validation, browser security configurations, and measures aimed at reducing unnecessary data exposure, including restrictions on cookies.

Under the Law on Electronic Communications (Official Gazette of the Republic of Macedonia no. 39/2014, as amended, “EC Law”), storing information or gaining access to information which is already stored in the subscriber’s or user’s terminal equipment is allowed only on the condition that the corresponding subscriber or user has given his/her consent after having previously received clear and comprehensive information, especially for the purposes of processing such data, in accordance with the data protection regulations. This should not prevent the technical storage of or access to information for the purpose of enabling the transmission of communications over a public electronic communications network, or if this is necessary for the provision of an information society service explicitly requested by the subscriber or user of the service.

Furthermore, the EC Law also prescribes that location data other than traffic data relating to users or subscribers may only be processed in anonymous form or based on prior consent of the user.

A new EC Law will begin to apply as of 1 June 2026, however, these provisions remain unchanged.