The framework
Montenegro's framework rests on the Law on Personal Data Protection (2008, as amended), with the AZLP as the supervisory authority.
That puts Montenegro in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law on Personal Data Protection (2008, as amended); GDPR-aligned replacement adopted on the EU accession track
Montenegro has operated a directive-era law since 2008 and adopted a GDPR-aligned replacement as part of its EU accession work; expect EU-style obligations as the new framework applies.
Marketing and advertising
Consent-first framework; GDPR alignment phasing in. That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad need an adequate destination or the authority's authorization.
Enforcement and penalties
The authority can impose administrative fines. Read the ceiling together with the authority's track record, which prices the risk.