Privacy in focus, over 1 thousand complaints in one year – AIP reports increase in cases

The Commissioner of the Agency for Information and Privacy (AIP), Krenare Sogojeva-Dermaku, has presented it in the Assembly of Kosovo before the Committee on Security and Defense Issues. the institution's work report for 2025, emphasizing the commitment to the protection of personal data and access to public documents.

According to the announcement, the Information and Privacy Agency (AIP) has exercised its field of activity in an objective and professional manner, in handling addressed complaints, providing advice and opinions to public and private institutions, citizens and other interest groups.

During 2025, AIP received a total of 1,085 complaints from institutions, organizations, media and citizens. In the field of access to public documents, 927 complaints were handled, while “832 complaints ended with administrative decisions while 175 complaints were carried over to 2026”.

Meanwhile, for the protection of personal data, the Agency has received 158 complaints, where "139 complaints have ended with administrative decisions while nineteen (19) complaints have been carried over to 2026".

In order to supervise the implementation of the law, AIP has carried out 367 inspections, of which 226 ex officio and 141 based on complaints.

The Agency has also emphasized efforts to align with European standards, announcing that it "has continued actions to finalize the Law on the Protection of Personal Data in Law Enforcement Institutions, in accordance with Directive (EU) 2016/680".

In terms of advice, 58 legal advices were provided to the public, private sector and citizens, while awareness-raising activities were numerous.

"During the period January-December 2025, over 80 information activities were carried out and over 807 participants were trained," the announcement states.

The Agency has also finalized four guidelines for the protection of personal data, including online privacy and the health sector, and has taken steps towards digitalization through the launch of the CMS system for case management.

On the international level, AIP has carried out over 20 activities and has actively participated in European mechanisms, including the European Data Protection Board.

According to the European Commission's 2024 report, "The Information and Privacy Agency has worked independently and efficiently," while legislation in this area is in line with European standards.

The annual report for 2025 is expected to be reviewed and approved by the Assembly of Kosovo.

Full disclosure, without interference:

The Commissioner of the Information and Privacy Agency, Krenare Sogojeva-Dermaku, presented on April 07, 2026, to the Assembly of Kosovo, respectively to the Committee on Security and Defense Issues.

The Agency for Information and Privacy (AIP) has exercised its field of activity in an objective and professional manner, in handling addressed complaints, providing advice and opinions to public and private institutions, citizens and other interest groups. Through professional expertise, the Agency has provided support to public and private institutions in drafting sub-legal acts and internal regulations for the protection of personal data and privacy policies.

In fulfilling its legal mandate to implement the right to protection of personal data and access to public documents, during the reporting period January - December 2025, the Agency has received a total of one thousand eighty-five (1,085) complaints addressed by public and private institutions, Non-Governmental Organizations, Media, Citizens and other interest groups. In implementing the right to access public documents, during 2025, the Agency has received a total of nine hundred twenty-seven (927) complaints, and eighty-ten (80) carried over from the previous year. Of this number, 832 complaints have ended with administrative decisions while 175 complaints have been carried over for 2026.

In exercising the right to personal data protection, the Agency received a total of one hundred and fifty-eight (158) complaints during 2025, and twelve (12) carried over from the previous year. Of this number, one hundred and thirty-nine (139) complaints were concluded with administrative decisions, while nineteen (19) complaints were carried over to 2026.

In order to supervise the implementation of the law and guarantee the protection of citizens' personal data, during the reporting period, the Agency carried out a total of 367 inspections. 226 inspections were carried out ex officio, while 141 inspections were carried out based on complaints addressed to the Agency.

In order to harmonize the legal framework with European standards, the Agency has continued actions to finalize the Law on the Protection of Personal Data in Law Enforcement Institutions, in accordance with Directive (EU) 2016/680 of the European Parliament and of the Council (known as the Law Enforcement Directive – LED).

The Agency has provided a total of fifty-eight (58) legal advice, of which twenty-nine (29) advice was issued to public sector institutions, seventeen (17) to private sector institutions, and twelve (12) advice to data subjects.

The Agency's activities in 2025 are focused on deepening cooperation with public and private institutions, non-governmental organizations and the media sector, promoting the right to the protection of personal data and access to public documents through training, workshops and awareness-raising campaigns aimed at promoting the rights to the protection of personal data and access to public documents.

In this context, during the period January-December 2025, over 80 information activities were carried out and over 807 participants from the public and private sectors were trained, including public officials, controllers and representatives from other interest groups, the health sector, the banking system, social centers, non-governmental organizations, the media and other entities.

Through professional expertise and with the aim of supporting controllers and processors from the public and private sectors, in fulfilling legal obligations and standardizing the approach when processing personal data, in accordance with the principles of accountability, proportionality and transparency, during this period, the Agency has finalized and published four (4) Guidelines for the Protection of Personal Data.

The Agency has taken concrete steps and actions in the functionalization of the digitalization process, by launching the CMS project - Case Management System, a project that directly impacts the improvement of the provision of services to various stakeholders who address the Agency, especially in the provision of better, transparent and more efficient services to citizens.

In the context of information and awareness, in the reporting period, the Agency has prepared 4 guidelines for the protection of personal data.

– Guide to online privacy

– Guidelines for lawful data processing

– Data Protection Impact Assessment Guide

– Guide for the health sector

In its efforts to strengthen the role of the state of Kosovo in the international arena, the Agency has carried out over 20 international activities with active participation in the European Data Protection Board (EDPP) forums, conferences, Working Groups.

Active participation in four (4) EDB Board meetings

Participation in four (4) Working Groups of an international nature

Organizer of two (2) international conferences with over ninety (90) representatives of personal data protection authorities at regional, international and global levels.

The European Commission's 2024 Kosovo Report assessing the work of the Information and Privacy Agency highlighted that

The Information and Privacy Agency has worked independently and efficiently.

Personal data protection laws are in line with GDPR and LED.

The agency has adopted bylaws and increased staff capacity.

Increased awareness has marked an increase in the responsibility of public and private institutions towards the Agency's decisions.