Cybersecurity law & regulation in Bosnia & Herzegovina (2026)
Cybersecurity in Bosnia & Herzegovina: sectoral rules.
Bosnia & Herzegovina has no comprehensive cybersecurity law and remains, as of mid-2026, the only country in South-East Europe without a formalised national CERT or cybersecurity strategy. Cybersecurity obligations are scattered across a new GDPR-aligned data protection law (applicable from October 2025), Criminal Code provisions criminalising attacks on information systems, and an entity-level CERT in Republika Srpska. EU accession pressure is driving calls for NIS2-aligned legislation, but no such bill has been formally tabled at state level.
Legal framework
Fragmented sectoral rules: new Law on Personal Data Protection (Official Gazette BiH, February 2025); Criminal Code cybercrime provisions; no dedicated national cybersecurity law, no national CERT, no national cybersecurity strategy
Key points: cybersecurity in Bosnia & Herzegovina
No dedicated cybersecurity law
Bosnia & Herzegovina has no standalone national cybersecurity act. OSCE, EU Cyber Direct, and the CESS think-tank all identify this as a critical gap, noting the country is unique in South-East Europe for lacking both a cybersecurity law and a national cybersecurity strategy.
New data-protection law (breach notification)
The Law on Personal Data Protection, adopted 30 January 2025 and applicable from 4 October 2025, introduces GDPR-aligned 72-hour mandatory data breach notification to the Personal Data Protection Agency and requires appointment of Data Protection Officers for certain controllers, the closest current analogue to an incident-reporting obligation.
Criminal Code cyber provisions
No national CERT; entity-level CERT only
No state-level national CERT exists. Republika Srpska established an entity-level CERT in 2015 under its Ministry for Scientific and Technological Development. A civil-society initiative (CSEC) informally fills some response functions for NGOs and critical-infrastructure operators at the state level, but has no formal mandate.
EU accession & NIS2 alignment pressure
As an EU candidate country, BiH is expected to transpose NIS2-equivalent rules as part of accession. The OSCE published strategic framework guidelines urging a national cybersecurity law harmonised with NIS2. The European Commission's 2024 Digital Public Administration Factsheet for BiH confirms the absence of a national network-and-information-security framework.
OSCE-supported capacity building (2025-2026)
The OSCE Mission to BiH held multiple cybersecurity conferences in 2025-2026, convening government, private sector, and academia to promote public-private partnership models and push for a state-level CERT and dedicated legislation, but no law has resulted yet.
Sources
- cess.org/wp-content/uploads/2025/06/CESS-Volten-Brief_12-2025_EN.pdf
- eucyberdirect.eu/atlas/country/bosnia-and-herzegovina
- osce.org/files/f/documents/1/a/438383.pdf
- cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
- iclg.com/practice-areas/cybersecurity-laws-and-regulations/bosnia-and-herzegov
- interoperable-europe.ec.europa.eu/sites/default/files/inline-files/NIFO_2024_Supporting%20Document_Bosn
- ncsi.ega.ee/country/ba/
- ceelegalmatters.com/briefings/31249-new-personal-data-protection-law-enters-into-force-in
- bih.osce.org/mission-to-bosnia-and-herzegovina/601848
- socwise.eu/building-cyber-resilience-without-borders-how-socially-based-cert-is-
- osce.org/mission-to-bosnia-and-herzegovina/597857
Next for Bosnia & Herzegovina: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026