GPS and worker monitoring in Montenegro: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior written information to workers and internal GPS rules (ZZPL art. 20; AZLP position)

  Yesrequired

  The employer must inform workers about the purposes, methods, data collected and rights, and adopt internal rules on GPS processing together with a preliminary assessment of the security measures.

  AZLP, posizione del Consiglio sull'uso del GPS nei veicoli di servizio (29.04.2025)

• Prior authorisation from the supervisory authority before setting up the data filing system (ZZPL art. 27)

  Yesrequired

  Unlike the GDPR, Montenegro retains an ex ante authorisation: before setting up a data filing system the controller must obtain the consent of the supervisory authority (if it does not reply within 30 days, consent is deemed granted).

  Legge sulla protezione dei dati (ZZPL), testo ufficiale inglese

• Basis = legitimate interest (art. 10), not consent; for private vehicles written consent and working hours only

  Yesrequired

  The basis is legitimate interest; for private vehicles used for work purposes the worker's written consent is required and the GPS must be limited to working hours.

  AZLP, posizione del Consiglio sull'uso del GPS nei veicoli di servizio (29.04.2025)

• No decisions about employees based solely on automated processing (ZZPL art. 15a)

  Yesrequired

  Decisions about employees' performance, reliability or conduct cannot be based solely on automated processing; the worker must be able to express their own position.

  AZLP, posizione del Consiglio sull'uso del GPS nei veicoli di servizio (29.04.2025)

• Formal data protection impact assessment (DPIA)

  It dependsonly in certain cases

  The current law does not provide for a formal GDPR-style DPIA; the substitute is the prior authorisation under art. 27 plus the security measures and the preliminary adequacy assessment (arts. 24 and 26).

  Legge sulla protezione dei dati (ZZPL), testo ufficiale inglese

The procedure, step by step

1. 1

   Define the purposes and methods of the GPS and adopt internal rules with a preliminary assessment of the security measures.

2. 2

   Obtain the prior authorisation of the supervisory authority before setting up the data filing system (art. 27).

3. 3

   Inform workers in writing; for private vehicles collect written consent and limit the GPS to working hours.

4. 4

   Do not base decisions about employees solely on automated processing (art. 15a).

5. 5

   Limit the GPS to working hours and to the declared purpose.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge sulla protezione dei dati (ZZPL), testo ufficiale inglese
• AZLP, posizione del Consiglio sull'uso del GPS nei veicoli di servizio (29.04.2025)
• AZLP (Garante montenegrino), contatti
• AZLP, moduli (richiesta di tutela dei diritti)
• Regolamento UE 2016/679 (GDPR), riferimento comparativo