The transfer of personal data to other countries can only be carried out if the other country provides an adequate level of protection of personal data. The Directorate evaluates the level of personal data protection provided by the other country based on:

  • the nature of the data;
  • the purpose and duration of the proposed processing operation or operations;
  • the country to which the data will be transferred;
  • rule of law and
  • security measures that exist in that country.

The Law on the Protection of Personal Data specifies the conditions that must be met by the state where the personal data is transferred. These rules do not apply to member states of the European Union and member states of the European Economic Area. If the Directorate considers that a certain third country does not provide an adequate level of protection in relation to the transfer of personal data, it will notify the European Commission and instruct the controller to stop the transfer of personal data.

The Directorate may allow the transfer of personal data to a country that will not provide at least the same level of protection of personal data as in the Republic of Macedonia, provided that adequate guarantees are provided for the protection of privacy, rights and freedoms of the subject of personal data.

Exceptions when transferring personal data to other countries:

  1. the subject of personal data has expressly agreed to transfer the data;
  2. the transfer is necessary for the implementation of an agreement between the subject of personal data and the controller or the implementation of pre-contractual measures taken in response to the request of the subject of personal data;
  3. the transfer is necessary for the purpose of concluding or fulfilling an agreement concluded in the interest of the subject of personal data, between the controller and a third party;
  4. the transmission is necessary for the protection of public interest or for public safety;
  5. the transfer is necessary for the purpose of establishing or realizing individual legal interests;
  6. the transfer is necessary for the protection of the life or essential interests of the subject of personal data and
  7. the transfer is made from publicly available collections of personal data or from collections of personal data available to a person who will make his legal interest probable to the extent determined by law.

According to Rulebook on the form and content of the form for recording the transfer of personal data, the controller within 15 days before the day of starting the transfer of personal data to other countries, should submit Application for transfer of personal data to other countries to the Directorate for Personal Data Protection in electronic and paper form.

The record of the transfer of personal data to other countries is kept in electronic form in the Directorate.