Video surveillance in Montenegro is not governed by general "reasonable expectation" principles. It is governed by a short, specific chapter of the Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "ZZPL") — Articles 34 to 40a — that says where a camera may point, who must decide to install it, what the sign must say, how long footage may be kept, and when the owners of an apartment building must agree first. Most of those rules carry a fine of €500 to €20,000 for a company (Article 74).
For a foreign company opening an office, a hotel or restaurant operator, an employer, or an investor who owns flats in a residential building, the practical effect is the same: a camera installed the way it would be at home can breach several of these articles at once.
Sources, checked 11 September 2026: the ZZPL ("Sl. list CG" 079/08, 070/09, 044/12, 022/17 and 077/24) in the consolidated text published by the supervisory authority, the Agency for Personal Data Protection and Free Access to Information (AZLP). The Agency's own list of applicable regulations, read on 11 September 2026, still links to that text. A bill to replace the ZZPL is before Parliament; it had not replaced this Act on that date, and the article numbers below are those of the Act in force. General information, not advice on a specific installation.
Four settings, four different rules
| Where the camera is | When it is allowed | Who decides | Hard limits |
|---|---|---|---|
| Access to business premises (entrances, exits) | For the safety of people and property, controlling entry and exit, or a risk to employees from the nature of the work (Article 35(1)) | The responsible person of the company, in a written decision with reasons (Article 35(2)-(3)) | Not the interior of residential buildings unconnected with the business entrance, not flat entrances; employees told in writing; no access to footage over the internet (Article 35(4)-(6)) |
| Inside business premises (the workplace) | Only if the safety of people or property, classified data or business secrets require it and it cannot be achieved another way (Article 36(1)) | The responsible person, after obtaining the opinion of the representative trade union or employee representative (Article 36(3)-(4)) | Not outside the workplace — in particular not in changing rooms, lifts, toilets or areas for clients and visitors; employees told in writing before it starts (Article 36(2), (5)) |
| Residential building (entrances, exits, common areas) | Entrances and exits of the building and its common areas (Article 38(1)) | The assembly of unit owners, in writing, by owners holding more than 70% of ownership of the building, block or entrance (Article 38(2)-(3)) | Never the entrances to flats (Article 38(4)) |
| Public areas | Under Articles 35 and 37 by analogy, unless a special law says otherwise (Article 40) | Prior consent of the supervisory authority is required for surveillance of a public area (Article 28(1), item 2a) | Without the required notice or consent, the authority orders the equipment removed (Article 40a) |
The written decision is not optional paperwork
Before a company films the access to its premises, its responsible person must adopt a written decision that states the reasons for introducing surveillance, unless a law itself prescribes the surveillance (Article 35(2)-(3)). The same applies to cameras inside the workplace (Article 36(3)) — with an extra step: before adopting the decision, the company must obtain the opinion of the representative trade union or, where there is none, the employee representative (Article 36(4)).
Two things follow in practice. First, the decision is the first document to have ready for any inspection; a camera without one is a fine on its own (Article 74(1), item 11). Second, the reasons in the decision define the lawful use of the footage. A decision adopted "for the security of property" is a weak basis for using the same footage to monitor productivity.
Where a camera may never point
The Act lists the places explicitly rather than leaving them to a balancing test:
- the interior of residential buildings unconnected with the entrance to business premises, and the entrances to flats (Article 35(4); Article 38(4));
- inside business premises but outside the workplace, in particular changing rooms, lifts, toilets and the areas intended for clients and visitors (Article 36(2)).
The last item surprises hospitality and retail operators. The general rule for filming inside business premises excludes the space set aside for clients and visitors. Coverage of an entrance for access control sits under Article 35; a camera trained on the customer area sits under the prohibition in Article 36(2).
The internet rule
For surveillance of access to business premises, the Act prohibits access to the footage through internal or public cable television, the internet or any other electronic communications means by which the recordings can be transmitted, whether live or afterwards (Article 35(6)). Many off-the-shelf systems are sold precisely for remote viewing on a phone. Configured that way at a business entrance, they sit squarely against the text.
Separately, every surveillance system must be protected from access by unauthorised persons (Article 39(5)), and failing to do so is a listed misdemeanour (Article 74(1), item 17).
The sign, and what it must say
A company that carries out video surveillance must display a public notice (Article 39(1)):
- in a visible place, so that people can learn of the surveillance before it begins, and at the latest when it begins (Article 39(2));
- stating who carries out the surveillance and a telephone number at which people can find out where and for how long the recordings are kept (Article 39(3)).
Displaying a compliant notice counts as informing people of the processing of their data by video surveillance (Article 39(4)). A sign with a camera pictogram and no operator name or phone number does not meet Article 39(3), and both the missing sign and the incomplete sign are separate fines (Article 74(1), items 15 and 16).
How long you may keep footage — and the entry log
Surveillance under Articles 35 and 36 must be recorded in a register, which may contain the recording itself, the date and time of entry and exit and, where collected, the person's name, address, employment, identity document and reason for entry (Article 37(1)-(2)). Personal data in that register may be kept for no more than six months from the day it was created (Article 37(3)).
A separate rule covers visitor logs. A business may ask a person entering to state the reason, give personal data and show an identity document where necessary (Article 33), and may keep a record of entries and exits; data in that record is kept for at most one year from collection unless a law provides otherwise (Article 34(1), (4)).
Apartment buildings and holiday lets
For owners of flats in Montenegro, Article 38 is the provision that matters most:
- surveillance may cover the building's entrances and exits and its common areas (Article 38(1));
- it needs the written consent of the assembly of unit owners (Article 38(2)), given when owners holding more than 70% of ownership of the building, block or entrance vote for it (Article 38(3));
- the entrance to a flat may not be filmed at all (Article 38(4)).
A camera over your own front door in a shared corridor is therefore not a private decision in Montenegro, even if you own the flat outright and let it to tourists. The misdemeanour provision reaches natural persons as well as companies: a responsible person or a natural person faces €150 to €2,000 (Article 74(2)), an entrepreneur €150 to €6,000 (Article 74(3)). How building assemblies take decisions, and what the common areas are, is set out in apartment ownership and common areas in Montenegro; the short-term rental rules are in the Airbnb and short-term rental guide.
Biometric access and other special cases
Fingerprint or face-recognition entry systems are not "video surveillance" in the Act's sense; they are biometric measures. For the public sector the Act allows them for entry and attendance only where a law prescribes them (Article 32), and for any controller, automated processing of biometric data is among the special-risk processing that needs the prior consent of the supervisory authority (Article 28(1), item 3) — unless the processing rests on a law, the person's consent or the performance of a contract with them (Article 28(2)). The wider employer obligations are in what a Montenegrin employer must do with staff data.
Fines
| Breach | Company | Article |
|---|---|---|
| Filming the interior of residential buildings unconnected with the entrance, or flat entrances | €500–€20,000 | 74(1), item 10 (Article 35(4)) |
| No written decision, or employees not informed in writing (business entrance) | €500–€20,000 | 74(1), item 11 (Article 35(2), (5)) |
| Filming inside business premises outside the workplace | €500–€20,000 | 74(1), item 12 (Article 36(2)) |
| Employees not informed in writing before workplace surveillance starts | €500–€20,000 | 74(1), item 13 (Article 36(5)) |
| Filming flat entrances in a residential building | €500–€20,000 | 74(1), item 14 (Article 38(4)) |
| No public notice in a visible place, or notice missing the required details | €500–€20,000 | 74(1), items 15-16 (Article 39) |
| System not protected from unauthorised access | €500–€20,000 | 74(1), item 17 (Article 39(5)) |
The responsible person in the company, or a natural person, faces €150 to €2,000 and an entrepreneur €150 to €6,000 for the same breaches (Article 74(2)-(3)). The list is specific: not every rule in the chapter carries its own item, but a failure to comply with an order or prohibition issued by the Agency does (Article 74(1), item 21).
A checklist before the installer arrives
- Which of the four settings is each camera in — business access, workplace, residential building or public area?
- Is there a written decision with reasons (Articles 35-36) and, for workplace cameras, the union or employee-representative opinion obtained first (Article 36(4))?
- Have employees been told in writing before recording starts (Articles 35(5), 36(5))?
- Does any camera cover a changing room, lift, toilet, client area or flat entrance (Articles 35(4), 36(2), 38(4))?
- Is remote viewing over the internet switched off for access cameras (Article 35(6)), and is the system protected from unauthorised access (Article 39(5))?
- Does the sign name the operator and give a phone number, and is it visible before the camera's field of view (Article 39)?
- Is footage deleted within six months (Article 37(3))?
- In a residential building, is there written consent from owners of more than 70% of ownership (Article 38(3))?
How we work on these files
We review the installation plan against Articles 35 to 39 before the cameras go up, draft the written decision and the employee notice, prepare the sign text, and — for residential buildings — prepare the assembly decision so that the 70% threshold is documented. The rest of a company's personal-data obligations sits with our data protection practice.
If you are fitting out premises, a hotel or a residential building in Montenegro, send us the camera plan, the purpose of each camera and the viewing arrangements. We will tell you which article each camera falls under, what has to be in writing before it is switched on, and which cameras have to move.
