Entities may transfer personal data which are subject to processing if the conditions set out in the DP Law are fulfilled and applied.

When transferring personal data to the EU or the European Economic Area (EEA), entities must notify the DPA at least 15 days before the transfer.

Transferring personal data to third countries or international organizations may be conducted only if the DPA deems that the third country or international organization provides adequate levels of protection. When assessing whether the third country or international organization has an adequate level of protection, the DPA considers several parameters, including, among others:

• the rule of law, respect for human rights and fundamental freedoms, relevant legislation and its implementation, professional rules and security measures (including rules for onward transfer), as well as effective and enforceable judgements applied to data subject and effective and administrative and judicial redress for data subjects whose personal data is transferred;
• the existence and effective functioning of one or more independent supervisory authorities in the third country or international organization;
• the international commitments the third country or international organization has entered into, or other obligations arising from legally binding conventions or instruments, in relation to the protection of personal data.

If the above criteria are met by the third country or international organization where the personal data will be transferred, the data transfer can be conducted on the basis of an adequacy decision adopted by the DPA.

The DPA has not yet adopted an adequacy decision. However, the DPA follows the practice of the European Union when it comes to implementing the data protection regulations, and it is expected that any such adequacy decision will be in line with an adequacy decision adopted by the European Commission.

The DP Law itself does not require a special / individual prior approval by the DPA (“Transfer Approval”) if an adequacy decision issued by the DPA for the (importing) third country or international organization exists or the below safeguards are provided (on condition that enforceable data subject rights and effective legal remedies for data subjects are available). However, up until this point in time, the DPA has had a conservative approach.

When an adequacy decision has not been adopted, personal data can be transferred to a third country or international organization only if the data controller or data processor apply appropriate safeguards, and on the condition that enforceable data subject rights and effective legal remedies for data subjects are available.

The appropriate safeguards may be provided by:

• a legally binding and enforceable instrument between public authorities or bodies;
• binding corporate rules in accordance with the DP Law;
• standard data protection clauses determined by the DPA or approved by the European Commission;
• an approved code of conduct or approved certification mechanism pursuant to the DP Law together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards the data subjects’ rights.

Additionally, the DPA could approve the following appropriate safeguards:

• contractual clauses between the data controller and the data processor, as well as the data controller, the data processor or the recipient of the personal data in the third country or international organization; or
• provisions envisaged in administrative agreements between public authorities or bodies which contain applicable and effective data subject rights.

The DP Law also provides a list of derogations for specific situations, based on which a legitimate data transfer out of the Republic of North Macedonia is not conditioned upon a Transfer Approval (e.g. data subject’s consent, enforcement of a contract between a data subject and a data controller, etc.).

Unofficially, starting from 2022, the DPA requires the submission of a performed transfer impact assessment with each request for Transfer Approval when transferring personal data to third countries and international organizations.

Even if the requirements to submit a request for Transfer Approval are not met, but the cross-border transfer of personal data is based on other bases, controllers / processors should still perform a documented transfer impact assessment.