The Agency for Personal Data Protection is established pursuant to the provisions of the Personal Data Protection Law (Official Gazette of Montenegro 79/08 and 70/09) as the supervisory authority. In performing affairs within its scope of work, the Agency is autonomous and independent. Agency bodies are the Council and the Agency Director.
The Parliament of Montenegro made a decision on the appointment of the President and two members of the Council of the Agency for Personal Data Protection on 10 December 2009.
The Director of the Agency was appointed in April 2010 and started working in May 2010. Concerning the creation of organisational conditions for the work of the Agency, upon the proposal of the Council, the Statute and the Rulebook on Internal Organization and Job Descriptions of the Agency were adopted at the meeting of the Administrative Board of the Parliament of Montenegro. Pursuant to Article 56 of the Personal Data Protection Law and Article 15 of the Statute, the Council of the Agency for Personal Data Protection has adopted a number of secondary legislation regulating the work of the Agency as follows:

- Work Rules; 
- Rulebook on Salaries, Allowances and Other Income of the Agency Employees; 
- Rulebook on Allowances for Increased Costs of Employees;
- Code of Conduct of the Employees; 
- Ethical Code; 
- Rulebook on Official Identification; 
- Rulebook on Usage of Official Cars and Fuel Costs; 
- Rulebook on Allocating Official Mobile Phones and Acknowledgement of Costs of Their Usage; 
- Rulebook on the Usage of Funds for Representation; 
- Guide for Accessing Information in the Possession of the Agency.
Rulebook on Internal Organization and Job Descriptions of the Agency envisages 22 jobs not including the positions of the President and members of Council. 

Personal Data Protection Agency performs affairs of a supervisory authority prescribed in the Personal Data Protection Law. In performing affairs within its scope of work, the Agency is autonomous and independent. The Agency has a status of a legal person. 
The competences of the Agency include performing administrative and technical affairs in the area of personal data protection.
The Agency:
- performs supervision over the implementation of personal data protection in accordance with this Law;
- decides on requests for the protection of rights;
- delivers opinions regarding the application of this Law;
- gives consent with regards to the establishment of personal data filing systems;
- delivers its opinion in the case of doubt whether a set of personal data is considered a filing system within the meaning of this Law;
- monitors the application of organisational and technical measures for personal data protection and proposes improvements of such measures;
- gives proposals and recommendations for the improvement of personal data protection;
- delivers opinions as to whether certain ways of personal data processing endanger the rights and freedoms of individuals;
- cooperates with bodies competent for supervision over the personal data protection in other countries;
- cooperates with competent state authorities in the process of preparation of regulations regarding personal data protection;
- puts forward the proposals for assessment of constitutionality of laws, that is constitutionality and lawfulness of other regulations and general acts governing the issues of personal data processing and
- performs other tasks in accordance with this Law. (Article 50 of the Personal Data Protection Law; Official Gazette of Montenegro 79/08 and 70/09)