OLYMP LogoOLYMP
Contact
Compliance guide

GDPR and outsourcing to Kosovo

Kosovo has a modern data protection law closely modelled on the GDPR, but no EU adequacy decision. That means transfers from the EU, UK or Switzerland are lawful with the right contracts and safeguards in place. This guide explains what those are.

Ask about our data protection set-upSee the steps
Why KosovoOutsourcing risksKosovo fact sheetGlossary

Can EU companies outsource to Kosovo under the GDPR?

Yes. Kosovo's Law No. 06/L-082 is closely modelled on the GDPR, but Kosovo has no EU adequacy decision, so transfers need a transfer tool. EU companies typically sign a data processing agreement and the European Commission's standard contractual clauses, document a transfer risk assessment, and keep data in their own systems with strict access controls.

Kosovo law
Law No. 06/L-082 on the protection of personal data (2019)
Regulator
Information and Privacy Agency (AIP)
EU adequacy
None; use standard contractual clauses
Also needed
Data processing agreement, transfer risk assessment

Setting up a compliant transfer, step by step

This is general information, not legal advice. Your data protection officer or counsel should confirm the set-up for your situation.

  1. Map the data

    Before the contract

    List which personal data the team will see, whose it is, why it is needed and in which systems it stays. Less access means less risk and simpler paperwork.

  2. Sign a data processing agreement

    With the contract

    Article 28 of the GDPR requires a contract that sets out the processing, the instructions, confidentiality, security, sub-processors and assistance with data subject requests.

  3. Add a transfer tool

    With the contract

    Because Kosovo has no adequacy decision, EU transfers usually use the European Commission's standard contractual clauses. UK transfers use the UK addendum or the UK's own transfer agreement.

  4. Assess the transfer

    Before go-live

    Document a transfer risk assessment that looks at Kosovo's law and practice and at the safeguards in place, such as access controls and encryption.

  5. Apply technical controls

    Before go-live

    Named accounts with multi-factor authentication, least-privilege access, managed devices, logging, and data kept in your own systems wherever possible.

  6. Review regularly

    Every year

    Recheck access rights, sub-processors, incidents and any changes in law, and update the records of processing and the assessment.

What controllers should check

Contracts make a transfer lawful; day-to-day controls make it safe. Both matter.

What does Kosovo's data protection law cover?

Law No. 06/L-082 sets principles, legal bases, data subject rights, security obligations and breach handling along the lines of the GDPR, and gives the Information and Privacy Agency supervisory and enforcement powers. A provider in Kosovo is bound by it for its own processing, in addition to the contract with you.

What should the data processing agreement cover?

  • Subject matter, duration, nature and purpose of the processing
  • Types of personal data and categories of data subjects
  • Processing only on your documented instructions
  • Confidentiality of everyone with access
  • Security measures, described concretely
  • Rules for sub-processors and your right to object
  • Help with data subject requests, breaches and assessments
  • Return or deletion of data at the end, and audit rights

Which technical controls should you expect?

  • Named accounts, single sign-on and multi-factor authentication
  • Access limited to the queues and fields each role needs
  • Managed, encrypted devices and restrictions on local downloads
  • Logging of access and regular access reviews
  • Clear procedures for leavers and for reporting incidents within agreed times
Continue reading

What about special categories of data?

Health, financial or other sensitive data call for a closer look: a data protection impact assessment, stricter access, and sometimes pseudonymisation or masking in the tools the team uses. Some regulated work may need to stay in-house or onshore; decide this before scoping the team.

Last reviewed: . Written and reviewed by the OLYMP BPO team in Prishtina, Kosovo. About the company

Data protection and Kosovo: common questions

Is Kosovo GDPR-compliant?

Kosovo is not in the EU, so the GDPR does not apply there directly. Kosovo's own Law No. 06/L-082 on the protection of personal data, in force since 2019, is closely modelled on the GDPR and is enforced by the Information and Privacy Agency. EU companies can transfer data to Kosovo lawfully with the right safeguards.

Does Kosovo have an EU adequacy decision?

No. The European Commission has not adopted an adequacy decision for Kosovo. Transfers from the EU therefore need another transfer tool, usually the standard contractual clauses, together with a transfer risk assessment and appropriate technical and organisational measures.

Which standard contractual clauses apply when outsourcing to Kosovo?

When an EU company is the controller and the Kosovo provider processes data on its behalf, the controller-to-processor module of the European Commission's 2021 standard contractual clauses is the usual choice. Your counsel should confirm the module and complete the annexes for your processing.

Can UK and Swiss companies outsource to Kosovo?

Yes. UK companies typically use the UK's International Data Transfer Agreement or the UK addendum to the EU clauses. Swiss companies can rely on the EU standard contractual clauses with the adaptations required under the Swiss Federal Act on Data Protection. Both also need a data processing agreement.

Does the data have to leave your systems?

Usually not. In most outsourcing set-ups, agents log into the client's own helpdesk, CRM or ERP, so the data stays in the client's systems and is only viewed or edited remotely. Remote access from Kosovo is still a transfer under the GDPR, but it keeps exposure low.

Sources

Legal references on this page link to their official sources. Laws and guidance change, so check the current versions.

  1. Information and Privacy Agency (Law No. 06/L-082), Republic of Kosovo
  2. Adequacy decisions, European Commission
  3. Standard contractual clauses for international transfers, European Commission
  4. Recommendations 01/2020 on supplementary measures for transfers, European Data Protection Board
  5. International transfers guidance, including the IDTA and addendum, Information Commissioner's Office, UK

Need our data protection documents?

Ask for our data processing agreement and security overview. Your DPO can review them before any commitment.

Request documentsWhy Kosovo