VPNs with servers in Montenegro

For internet access, the Government’s regulation (Official Gazette 156/25 of 26 December 2025, applying from 1 January 2026) lists the assigned user name, the public or translated address and port, the destination address and port, the protocol, the destination domain name and the traffic per session. An operator is a person providing public electronic communications networks or services; whether a VPN operator is one is not established.

The Law on the National Security Agency (Official Gazette 40/26, in force from 23 March 2026) was challenged in an initiative lodged with the Constitutional Court in May 2026, which says articles 13, 18 and 20 allow access to databases, surveillance in public places and collection of location data without court approval, and recalls the Constitutional Court’s decision U-I 34/11 of 23 July 2014 on communications data.

Under article 107(4) of the same Law, the regulator may require providers of public networks or services to block end users’ access to numbers or services where the competent authorities report fraud or abuse, or where this is needed to protect the general interest or the rights and freedoms of others.

Article 370(1) of the Criminal Code punishes publicly inciting violence or hatred against a group, or a member of a group, defined by race, colour, religion, origin, nationality or ethnic affiliation, with imprisonment of six months to five years; the penalty provision was last amended in Official Gazette 110/23 of 12 December 2023.

An account can be tied to a person through the retained data above: the address and port assigned to a user and the data identifying the end user are among the categories operators keep, and the Interior Ministry sets the conditions on which competent bodies receive them (art. 173(8)).

Article 42 of the Constitution makes letters, telephone conversations and other means of communication inviolable, and permits a departure only on a court decision where criminal proceedings or the security of Montenegro require it. The authority competent for personal data protection supervises the security of retained data (art. 175(2) of the Law).

The order of the rows is the security score, and a server’s location is not a recommendation.