Personal Data Protection Agency clarifies rules for requesting ID documents in BiH

The Personal Data Protection Agency of Bosnia and Herzegovina has clarified the legal limits regarding the collection of sensitive personal information, such as national ID numbers (JMBG), ID card copies, and residency certificates. The Agency emphasizes that not all entities have the right to request such data; only individuals or legal entities with a specific legal basis, known as data controllers, are permitted to do so.

While certain institutions like banks are legally obligated to verify client identities in specific procedures, this authority does not extend to all service providers or retailers. If a request for personal data is not mandated by law, the entity must obtain the voluntary consent of the citizen. This is common in scenarios involving direct marketing or promotional offers, and citizens maintain the right to withdraw such consent at any time.