North Macedonia Law on Personal Data Protection and hosting in the EU

A practical guide for Macedonian businesses, developers and agencies deciding where to host customer data. Status as of 30.09.2026. This is general information, not legal advice.

Short answer

1. 1North Macedonia's Law on Personal Data Protection is published in the Official Gazette as No. 42/2020 and is supervised by the Agency for Personal Data Protection (azlp.mk).
2. 2Legal guides (CMS, DLA Piper) report that it entered into force on 24 February 2020 and became applicable on 24 August 2021, after an 18-month transition period.
3. 3The same guides describe it as aligned with the EU GDPR: data subject rights, data protection officers, breach notification and administrative fines.
4. 4North Macedonia is not on the European Commission's list of countries with an adequacy decision, so moving personal data from the EU to it needs another transfer tool.
5. 54hosting servers are in the EU (Frankfurt), not in North Macedonia. Where a server stands does not, on its own, make you compliant or non-compliant.

What the law is and what we could confirm

The Law on Personal Data Protection is cited as Official Gazette of the Republic of North Macedonia No. 42/2020. According to the legal guides published by CMS and DLA Piper, it entered into force on 24 February 2020 and became applicable on 24 August 2021, and it replaced the 2005 law. The same sources describe alignment with the GDPR, including breach notification duties added by a later amendment.

We could not open the official text of the law, so we do not quote article numbers, notification deadlines or fine amounts from it. The supervisory authority is the Agency for Personal Data Protection (azlp.mk); check the official text and its guidance before you decide.

What this means for hosting in the EU

The European Commission's list of adequacy decisions does not include North Macedonia. Data that leaves the EU for North Macedonia therefore needs a transfer tool such as standard contractual clauses. Data that stays on a server in Frankfurt does not cross that border, but you remain the controller of what you collect from your customers.

The practical side is the same as anywhere: a written processing agreement with the host, a clear list of who can access the machine, tested backups, and a way to detect and report an incident.

Latency is a separate question. Serving visitors in North Macedonia from Frankfurt means a longer network path than a local datacentre would give. For most business sites and back-office applications that is acceptable; for real-time workloads test from your own location first.

Three realistic examples

Common mistakes

• Assuming a server abroad puts the data outside the law. Your duties as controller follow the data and the people, not the machine.
• Quoting article numbers, deadlines or fines from a blog post instead of the official text of the law.
• Having no written agreement with the hosting provider or other processors.
• Keeping backups nobody has ever restored, or forgetting that backups also contain personal data.
• Treating the EU adequacy list as if it covered North Macedonia; it does not.

How 4hosting helps

We host in the EU, in Frankfurt. We offer a data processing agreement (DPA) under Article 28 GDPR and standard contractual clauses for transfers, free migration, and DevOps hours included in every subscription (cPanel from the Advanced plan). The hours can be used for hardening, backup and restore tests, and logging.

We are not a compliance certifier. We hold no ISO 27001, SOC 2 or NIS2 certification; our practice is aligned with ISO 27001. We do not sign legal compliance on your behalf.

Frequently asked questions

See also

• 4hosting in North Macedonia
• GDPR and data processing agreement at 4hosting
• Backup and recovery