The framework
The operative statute in Bosnia and Herzegovina is the Law on Protection of Personal Data (2006), enforced by the Personal Data Protection Agency.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Law on Protection of Personal Data
Runs a 2006-era law; a GDPR-aligned draft has circulated for years without passage. Compliance built for the EU comfortably exceeds local requirements.
Marketing and advertising
Consent-first framework from the pre-GDPR era. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Transfers abroad require the authority's authorization. In practice, the binding transfer rules for most international campaigns touching this market come from the origin jurisdiction of the data.
Enforcement and penalties
Administrative fines are modest. How often the authority actually enforces sets the real price.