GPS and worker monitoring in Bósnia e Herzegovina: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Informing workers and a valid legal basis (new law 12/25)

  Yesrequired

  The new law, aligned with the GDPR, requires one of the six legal bases provided for and that workers be informed about the processing of their data, including GPS.

  Nuova Legge sulla protezione dei dati personali (Gazzetta BiH 12/25, in vigore 2025)

• Prior authorisation or registration with an authority before installing

  Nonot required

  The new law replaces the general obligation to register with the Agency with keeping an internal record of processing activities.

  DLA Piper, protezione dei dati in Bosnia ed Erzegovina

• Basis = legitimate interest, not consent

  Yesrequired

  The usual basis is legitimate interest; in the employment relationship consent is a weak basis because of the imbalance of power.

  Nuova Legge sulla protezione dei dati personali (Gazzetta BiH 12/25, in vigore 2025)

• Proportionality and data minimisation of the processing

  Yesrequired

  The processing must respect minimisation and proportionality, in line with the alignment to the GDPR.

  Nuova Legge sulla protezione dei dati personali (Gazzetta BiH 12/25, in vigore 2025)

• Impact assessment (DPIA) for monitoring employees, including GPS (AZLP list, November 2025)

  Yesrequired

  The AZLP list expressly includes the processing of employee data through apps or monitoring systems, including GPS systems on vehicles, among the cases that require an impact assessment.

  AZLP, lista dei trattamenti che richiedono una DPIA (novembre 2025, include il monitoraggio dei dipendenti e il GPS)

The procedure, step by step

1. 1

   Identify a valid legal basis (legitimate interest) and keep the internal record of processing activities.

2. 2

   Inform workers about the processing (including GPS).

3. 3

   Carry out the impact assessment (DPIA) for monitoring employees.

4. 4

   Apply minimisation and proportionality.

5. 5

   Configure the system in a way proportionate to the stated purpose.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Nuova Legge sulla protezione dei dati personali (Gazzetta BiH 12/25, in vigore 2025)
• AZLP, lista dei trattamenti che richiedono una DPIA (novembre 2025, include il monitoraggio dei dipendenti e il GPS)
• AZLP (Garante bosniaco), pagina ufficiale
• DLA Piper, protezione dei dati in Bosnia ed Erzegovina
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo