Compliance of Technical and Organizational Data Protection Measures with the New Law on Personal Data Protection of Bosnia and Herzegovina (2025) and the NIS2 Directive: A Comparative Doctrinal and Gap Analysis

Prepared By Editor-in-Chief

International Journal of Innovative Solutions in Engineering is published semi-annually.

ISSN: 3029-3200

Preliminary Communication

DOI: 10.47960/3029-3200.2026.S1.1.126
Citations (Crossref, OpenAlex): …
Admir Sivro* ORCID profile of Admir Sivro and Jasmin Azemović ORCID profile of Jasmin Azemović
*CAadmir.sivro@edu.fit.ba
jasmin@edu.fit.ba

Full text:

Special Issue No. 1 Article 34

This article belongs to the Special Issue No. 1, 2026 on Security 4.0 – Cybersecurity and Digital Resilience of Information Systems (CYRES 2026)


A. Sivro and J. Azemović, “Compliance of Technical and Organizational Data Protection Measures with the New Law on Personal Data Protection of Bosnia and Herzegovina (2025) and the NIS2 Directive: A Comparative Doctrinal and Gap Analysis,” International Journal of Innovative Solutions in Engineering, no. S1, pp. 126–138, Oct. 2026, doi: 10.47960/3029-3200.2026.S1.1.126.

pages 126-138

Download a citation file:

Preview and download a citation file in BibTex format that can be imported by citation management software, including Mendeley, EndNote, ProCite, RefWorks, and Reference Manager.

This article is archived in Zenodo

Zenodo Archive DOI: 10.5281/zenodo.VAŠ_ID

Abstract

Modern information systems face growing cybersecurity regulatory requirements as the EU enforces both the General Data Protection Regulation (GDPR) and the NIS2 Directive (EU 2022/2555). Although not an EU member state, Bosnia and Herzegovina adopted a new, GDPR-aligned Law on Personal Data Protection in early 2025, while regional initiatives increasingly reference NIS2 standards. This paper maps and compares the technical and organizational measures prescribed by the Bosnian law against the ten security-measure categories of Article 21 of NIS2, identifying the degree of coverage and regulatory gaps. The study used qualitative comparative document analysis, with two independent coders reviewing the primary legal texts. Results show the law conceptually addresses nine of ten categories, with a dominant pattern of partial coverage (70%): it establishes security principles but rarely reaches the technical detail required by NIS2. Only cryptography/encryption and effectiveness assessment (20%) are fully covered, while multi-factor authentication (10%) remains unaddressed. An internal asymmetry emerges within the law: more precise technical elaboration of access controls for competent authorities in the criminal-law context than for economic operators, the primary NIS2 addressees. The findings offer a basis for recommendations to BiH regulators and organizations and a starting point for future regional research.

Keywords

Personal Data Protection, NIS2, Cybersecurity, GDPR, Regulatory Compliance, Bosnia and Herzegovina.

ijise ID

34

URI

https://ijise.ba/article/34/

Publication Date

In Press

References

  1. European Union Agency for Cybersecurity (ENISA), “Supporting NIS2 Implementation Through Actionable Guidance-Technical Implementation Guidance on Cybersecurity Risk Management Measures,” 2025. [Online]. Available: https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
  2. International Association of Privacy Professionals (IAPP), “NIS2 Directive: Mapping the Interplays with the GDPR,” 2026. [Online]. Available: https://iapp.org/resources/article/mapping-interplays-gdpr-nis2 . [Accessed: 17-Aug-2026].
  3. European Parliament and Council, “Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation),” Official Journal of the European Union, OJ L 119, pp. 1-88, 4 May 2016. [Online]. Available: https://eur-lex.europa.eu/eli/reg/2016/679/oj
  4. K. Hjerppe, J. Ruohonen, and V. Leppanen, “The General Data Protection Regulation: Requirements, Architectures, and Constraints,” in 2019 IEEE 27th International Requirements Engineering Conference (RE), Jeju Island, Korea (South): IEEE, Sep. 2019, pp. 265–275. doi: 10.1109/RE.2019.00036.
  5. European Parliament and Council, “Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive),” Official Journal of the European Union, OJ L 333, pp. 80-152, 27 Dec. 2022. [Online]. Available: https://eur-lex.europa.eu/eli/dir/2022/2555/oj
  6. European Commission, “Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures,” Official Journal of the European Union, 7 Nov. 2024. [Online]. Available: https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj
  7. M. Kianpour, P. A. Earls Davis, and I. M. Windekilde, “Digital sovereignty in practice: analyzing the EU’s NIS2 directive,” Int. J. Inf. Secur., vol. 24, no. 4, p. 167, Aug. 2025, doi: 10.1007/s10207-025-01090-4.
  8. J. Ruohonen, “A Systematic Literature Review on the NIS2 Directive,” arXiv preprint, arXiv:2412.08084, Dec. 2024. [Online]. Available: https://arxiv.org/abs/2412.08084
  9. D. Shamatonova, “The importance of the NIS2 Directive and the potential challenges it entails,” JARSSH, vol. 11, no. 1, pp. 46–48, Mar. 2025, doi: 10.61841/7k8bwj71.
  10. J. Ruohonen, K. Hjerppe, and E.-Y. Kang, “A Mapping Analysis of Requirements Between the CRA and the GDPR,” in 2025 IEEE 33rd International Requirements Engineering Conference Workshops (REW), Valencia, Spain: IEEE, Sep. 2025, pp. 215–222. doi: 10.1109/REW66121.2025.00034.
  11. C. Negri-Ribalta, M. Lombard-Platet, and C. Salinesi, “Understanding the GDPR from a requirements engineering perspective—a systematic mapping study on regulatory data protection requirements,” Requirements Eng, vol. 29, no. 4, pp. 523–549, Dec. 2024, doi: 10.1007/s00766-024-00423-4.
  12. United Nations Development Programme (UNDP) Slovakia, “Cybersecurity for a Resilient Digital Future,” 2025. [Online]. Available: https://publicfinance.undp.sk/en/regional-project-cybersecurity/ . [Accessed: 17-Aug-2026].
  13. “Global Cyber Policy Dialogues: Western Balkans,” Meeting Summary, Observer Research Foundation (ORF) America, Apr. 2026. [Online]. Available: https://orfamerica.org/recent-events/global-cyber-policy-dialogues-western-balkans-montenegro . [Accessed: 17-Aug-2026].
  14. European Commission, “NIS2 Directive: securing network and information systems,” Shaping Europe’s Digital Future, 2025. [Online]. Available: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive [Accessed: 17-Aug-2026].
  15. European Cyber Security Organisation (ECSO), “NIS2 Directive Transposition Tracker,” 2026.
  16. K. Kepuska and M. Tomasevic, “A lightweight framework for cyber risk management in Western Balkan higher education institutions,” PeerJ Computer Science, vol. 10, p. e1958, Apr. 2024, doi: 10.7717/peerj-cs.1958.
  17. L. Puljak, A. Mladinić, R. Iphofen, and Z. Koporc, “Before and after enforcement of GDPR: Personal data protection requests received by Croatian Personal Data Protection Agency from academic and research institutions,” Biochem. med. (Online), vol. 30, no. 3, pp. 363–370, Oct. 2020, doi: 10.11613/BM.2020.030201.
  18. D. Mellafe Z., “The Coverage Gap: Chile’s Cyber Disclosure Framework versus the USA, EU and UK,” arXiv preprint, arXiv:2606.05594, Jun. 2026. [Online]. Available: https://arxiv.org/abs/2606.05594
  19. Parliamentary Assembly of Bosnia and Herzegovina, “Law on Personal Data Protection,” Official Gazette of BiH, no. 12/25, 28 Feb. 2025. [Online]. Available: https://www.sluzbenilist.ba/page/akt/aCRNh0ohz4nh78h77P7BE=
  20. CMS Legal Services EEIG, “Data protection and cybersecurity laws in Bosnia and Herzegovina,” CMS Expert Guide to Data Protection and Cyber Security Laws, 2025. [Online]. Available: https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/bosnia-and-herzegovina [Accessed: 17-Aug-2026].
  21. CEE Legal Matters / Lexology, “New Personal Data Protection Law Enters Into Force in Bosnia and Herzegovina,” Nov. 2025. [Online]. Available: https://www.lexology.com/library/detail.aspx?g=27daf304-9c5b-4c79-a8bb-c6e861fbc1af . [Accessed: 17-Aug-2026].
  22. M. Seeba, M. Valgre, and R. Matulevičius, “Evaluating Organization Security: User Stories of European Union NIS2 Directive,” in Advanced Information Systems Engineering, vol. 15701, J. Krogstie, S. Rinderle-Ma, G. Kappel, and H. A. Proper, Eds., Cham: Springer Nature Switzerland, 2025, pp. 57–74. doi: 10.1007/978-3-031-94569-4_4.
  23. NIS2-Templates.com, “Your NIS2 Gap Analysis in 5 Phases,” 2026. [Online]. Available: https://www.nis-2-templates.com/gap-analysis/ . [Accessed: 17-Aug-2026].
  24. S. P. Otta, S. Panda, M. Gupta, and C. Hota, “A Systematic Survey of Multi-Factor Authentication for Cloud Infrastructure,” Future Internet, vol. 15, no. 4, p. 146, Apr. 2023, doi: 10.3390/fi15040146.
  25. J. Ruohonen and P. Timmers, “Vulnerability Coordination under the Cyber Resilience Act,” Applied Cybersecurity & Internet Governance, Nov. 2025, doi: 10.60097/ACIG/213350.
  26. J. Ruohonen, “A review of product safety regulations in the European Union,” Int. Cybersecur. Law Rev., vol. 3, no. 2, pp. 345–366, Dec. 2022, doi: 10.1365/s43439-022-00057-8.
  27. S. Park and J. D. Hastings, “Weak Enforcement and Low Compliance in PCI DSS: A Comparative Security Study,” in 2026 14th International Symposium on Digital Forensics and Security (ISDFS), Boston, MA, USA: IEEE, Mar. 2026, pp. 1–6. doi: 10.1109/ISDFS69419.2026.11458981.
  28. J. Ruohonen and K. Hjerppe, “The GDPR enforcement fines at glance,” Information Systems, vol. 106, p. 101876, May 2022, doi: 10.1016/j.is.2021.101876.
Views: 24

State-Machine Oscillations and Anomaly Detection in PX4 Offboard Mode Using Timed Automata Observers

Separation of Duties Without Shared Oversight: A Threat Model of the Identity Document Issuance Process in Bosnia and Herzegovina

ISSN: 3029-3200

Reach out to us for more opportunities

If you have any inquiries, please use the information below to contact us.

Contact Us

All articles published in the International Journal of Innovative Solutions in Engineering (IJISE) are preserved in Zenodo for long-term archiving and global accessibility.

© 2026 by The Author(s). Licensee IJISE by Faculty of Mechanical Engineering, Computing and Electrical Engineering, University of Mostar. All articles are an open-access and distributed under the terms and conditions of the CC BY 4.0Creative Commons LicenseAttribution 4.0 International (CC BY 4.0)