The new Law on Personal Data Protection was published in the Official Gazette of Bosnia and Herzegovina, no. 12/25, and aligns local rules with the EU General Data Protection Regulation (GDPR). It has applied since 4 October 2025. It is supervised by the Personal Data Protection Agency of Bosnia and Herzegovina and provides for substantial fines for both the company and the responsible person.
For a website this is not an abstract topic. Every contact form, newsletter, Google Analytics, embedded map or video collects some personal data — if only an IP address. This guide shows what to check and how to fix it technically.
Short answer
Your site needs a clear privacy policy, forms that ask only for necessary data, consent before loading analytics and marketing tools, HTTPS and agreements with suppliers who process data for you (hosting, email, newsletter). The law gives two years from its entry into force to align processing that already existed, but new forms and tools should follow the new rules right away.
What counts as personal data on a website
Personal data is any information that identifies a person, directly or indirectly. On a website that is most often:
- name, email and phone number from a contact form, order or newsletter sign-up;
- IP addresses and identifiers in cookies used by analytics and ads;
- behavioural data (which pages someone views, where they come from) when linked to a person or device;
- data from job applications, appointment bookings or user accounts.
Privacy policy: what it must contain
The law requires you to inform people clearly and plainly when you collect their data. A privacy policy should state at least:
- who you are (company name, address, contact) and the data protection officer’s contact, if you have one;
- what data you collect and for what purposes;
- the legal basis for each purpose — for example answering an enquiry, fulfilling an order, a legal obligation or consent;
- who receives the data (hosting, email service, courier, accountant) and whether it is transferred outside BiH;
- how long data is kept;
- people’s rights: access, rectification, erasure, restriction, objection, portability and withdrawing consent;
- the right to lodge a complaint with the Personal Data Protection Agency.
Requests from individuals must be answered within 30 days. The policy must not be copied from someone else — it has to describe what your website actually does.
Contact forms and newsletters
- Ask only for what you need. Name, email and message are usually enough for an enquiry. Make the phone number optional.
- A short note next to the form with the purpose and a link to the privacy policy.
- Consent only where it is the legal basis. You don’t need an “I agree” checkbox to answer an enquiry — you process the data to respond to the request. A newsletter needs separate consent that is not pre-ticked and can be withdrawn easily.
- Be able to prove consent — record when and how it was given, and use email confirmation for newsletters.
Cookies, analytics and embedded content
Cookies and similar identifiers that track visitors are processing of personal data. In practice:
| Type | Example | What to do |
|---|---|---|
| Strictly necessary | Cart, chosen language, form protection | Describe in the policy; consent usually not needed |
| Analytics | Google Analytics | Load only after consent, or use cookieless analytics |
| Marketing | Meta Pixel, Google Ads | Only with consent |
| Embedded services | YouTube videos, Google Maps, fonts from Google’s servers | Load on click or host locally |
A cookie banner must make refusing as easy as accepting. A banner that only says “we use cookies” while analytics already loads solves nothing. Fonts are best hosted on your own server — the site is faster too, as explained in why is my website slow.
Suppliers that process data for you
Your host, email service, newsletter tool, CRM or booking system process data on your behalf. You need an agreement or terms that cover data processing, and you should know in which country the data is stored. The law has specific rules for transfers outside BiH, so prefer services that state clearly where and how they store data.
Security and data breaches
- HTTPS across the whole site and regular backups.
- An up-to-date system and plugins — most break-ins on small sites come through outdated plugins.
- Admin access only for the people who need it, with two-factor authentication.
- An incident plan: a personal data breach must be reported to the Agency within 72 hours of becoming aware of it, unless it poses no risk to people’s rights.
Checklist for your website
- An up-to-date privacy policy, linked from the footer of every page.
- Forms ask only for necessary data and include a note with a link to the policy.
- Analytics and marketing tools don’t load before consent.
- Videos and maps load only on click, or locally hosted resources are used.
- The site runs exclusively over HTTPS.
- You know where form submissions are stored and for how long.
- You — not just your developer — have access to and copies of all data.
Public institutions, healthcare providers and businesses that process sensitive data have additional obligations, such as appointing a data protection officer. If you work with patients, see also the guide online appointment booking.
Note
This guide describes the technical alignment of a website and is not legal advice. For interpreting the law in your case, consult a lawyer or the Personal Data Protection Agency of Bosnia and Herzegovina.
Want your website checked?
I review the forms, cookies, analytics and embedded services on your site, and you get a list of technical changes needed for compliance. Send me the address of your website.
Engimotive · Published October 28, 2026