Bosnia and Herzegovina

Art. 8 lists the grounds for lawful processing, Art. 9 covers consent and Art. 11 special categories. Chapter II (Arts. 14-25) gives data subjects access (Art. 17), rectification (Art. 18), erasure (Art. 19), restriction (Art. 20), portability (Art. 22), objection (Art. 23) and protection against automated decisions (Art. 24).

Art. 35 requires the controller to notify the Agency without undue delay and, where possible, within 72 hours of becoming aware of a breach, unless it is unlikely to risk individuals' rights. Art. 36 requires notice to data subjects without delay where the breach is likely to create a high risk.

Art. 98(c) of the consolidated Labour Law (44/22) bars dismissal for raising a reasonable suspicion of corruption or reporting it in good faith to responsible persons or competent state authorities. Art. 98(b) bars dismissal for a complaint or proceedings against the employer over a violation of law, a collective agreement or work rules.

Art. 11 covers identifying and verifying the customer and beneficial owner, the purpose of the relationship, ongoing monitoring and PEP checks. Art. 12 applies the measures to business relationships, to transactions of 30,000 KM or more and to any suspicion of ML/TF; Art. 4 uses a 25% ownership indicator for beneficial owners.