Processes personal data, in Serbia

Law on Personal Data Protection, arts. 16-19 (special categories of personal data and minors), Official Gazette RS No. 87/2018 · Read the law's page

• Do not process data revealing racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or process genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the person's explicit consent for one or more specified purposes.
• Where a minor is 15 years old or older, their own consent is enough to process personal data for an information-society service; below that age, get consent from the parent exercising parental responsibility or another legal representative, and take reasonable steps to verify it.
• Process data about a person's criminal convictions, offences, or related security measures only under the control of, or as specifically permitted by law for, a competent authority, and keep any unified register of criminal convictions solely under that authority's control.
• Where a competent authority processes special categories of personal data for law-enforcement or national-security purposes, apply Article 18's narrower list of exceptions instead of Article 17's, and only where necessary and accompanied by appropriate safeguards.

Law on Personal Data Protection, arts. 21-37, 39-40 (rights of the data subject), Official Gazette RS No. 87/2018 · Read the law's page

• Tell a person, at the time you collect their personal data from them, your identity and contact details, the purpose and legal basis of processing, the recipients, any cross-border transfer, the retention period, and their rights.
• Where personal data was not collected from the person, give them the same information, plus its source and category, within a reasonable time and no later than when you first communicate with them or disclose the data to someone else.
• Answer a person's request to know whether you process their data, and if so give them access to it along with the purpose, categories, recipients and retention period.
• Correct a person's inaccurate personal data without undue delay on request, and let them complete incomplete data, including by providing a supplementary statement.
• Erase a person's personal data without undue delay once it is no longer necessary for its purpose, consent is withdrawn with no other ground, the person objects with no overriding ground, it was processed unlawfully, or erasure is required by law.
• Restrict processing on request while accuracy is disputed, the processing is unlawful but the person opposes erasure, you no longer need the data but the person needs it for a legal claim, or an objection is pending.
• Tell every recipient the data was disclosed to about a correction, erasure or restriction, unless that is impossible or requires disproportionate effort.
• Give a person their previously supplied personal data in a structured, commonly used, machine-readable format on request, and let them transmit it to another controller without hindrance.
• Stop processing a person's data for direct marketing, including related profiling, the moment they object, and tell them about this right clearly and separately no later than your first contact with them.

Law on Personal Data Protection, arts. 52-53 (personal data breach notification), Official Gazette RS No. 87/2018 · Read the law's page

• Notify the Commissioner of a breach that may create risk to a person's rights and freedoms without undue delay, and within 72 hours of becoming aware of the breach where that is possible; give reasons for any delay beyond 72 hours.
• As a processor, notify the controller without undue delay after becoming aware of a breach.
• Notify the affected person of a breach without undue delay, in clear language, whenever the breach may create high risk to their rights and freedoms.
• Describe in the Commissioner notification the nature of the breach, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed, and supply the information in phases without undue further delay where it cannot all be given at once.
• Document every breach, including its facts, effects and remedial action, so the Commissioner can assess compliance.
• Skip notifying the affected person only where you have made the data unintelligible, such as by encryption, where subsequent measures have removed the high risk, or where notifying would take disproportionate effort and you have made an equally effective public communication instead; the Commissioner can still order the notice.

Law on Personal Data Protection, arts. 63-72 (transfer of personal data to other states and international organizations), Official Gazette RS No. 87/2018 · Read the law's page

• Transfer personal data outside Serbia freely only to a country, part of a country, sector, or international organization the Commissioner has found to ensure an adequate level of protection, a status presumed for parties to the Council of Europe's Convention 108 on automatic processing of personal data.
• Absent an adequacy finding, transfer only where you have put in place appropriate safeguards, such as standard contractual clauses issued by the Commissioner, a legally binding instrument between authorities, or Commissioner-approved binding corporate rules, and only where the person retains enforceable rights and effective legal remedies.
• Get the Commissioner's approval for binding corporate rules before relying on them, showing they legally bind every group member and its employees and expressly grant the person enforceable rights.
• Do not recognize or comply with a foreign court's or authority's order to transfer or disclose personal data unless it rests on an international agreement, such as a mutual legal assistance treaty between Serbia and that country.
• Absent an adequacy finding or safeguards, transfer personal data only under a listed derogation, such as the person's explicit and informed consent to the transfer, or necessity for a contract or an important public interest.

Law on Personal Data Protection, arts. 73-87 and 95 (the Commissioner, legal remedies and penalties), Official Gazette RS No. 87/2018 · Read the law's page

• Expect the independent Commissioner for Information of Public Importance and Personal Data Protection to supervise compliance, free from external instruction, with inspection, information-demand and corrective powers.
• Expect a person in Serbia to be able to complain to the Commissioner about processing they believe violates this law, and to challenge the Commissioner's decision in an administrative dispute within 30 days.
• Expect a person to be able to authorize a privacy advocacy association to represent them in a complaint, an administrative dispute, a court action, or a damages claim.
• Expect a person in Serbia to have a court-enforceable damages claim under Article 86 for material or non-material harm from an infringement of this law, separate from a complaint to the Commissioner, with the controller liable and a processor liable only where it acted outside the controller's lawful instructions.
• Expect fines to be set case by case for an effective, proportionate and dissuasive effect, weighing the nature, gravity and duration of the violation, intent or negligence, mitigation efforts, prior violations, cooperation with the Commissioner, and the categories of data involved.
• Expect a fine of 50,000 to 2,000,000 dinars for a legal-entity controller or processor's breach of most of the act's substantive duties, smaller fixed fines for narrower violations, 5,000 to 150,000 dinars for a natural person or a responsible person, and 20,000 to 500,000 dinars for an entrepreneur, imposed as a misdemeanor sanction rather than a criminal offense.

Zakon o zastiti podataka o licnosti (Law on Personal Data Protection), Official Gazette RS No. 87/2018, arts. 1-15, 20, 41-51, 54-62, 88-94 (general provisions, principles, lawful basis, controller and processor obligations, data protection impact assessment, data protection officer, and special processing cases) · Read the law's page

• Have one of the lawful grounds Article 12 lists, such as consent, contract necessity, legal obligation, vital interest, public interest, or legitimate interest, before processing personal data of a person in Serbia.
• Take consent only where you can demonstrate it was given, present a bundled consent request separately from other matters in plain, simple language, and let the person withdraw consent at any time as easily as they gave it.
• Take appropriate technical, organizational and staff measures proportionate to the processing's risk, keep them under review, and be able to demonstrate compliance.
• Build data protection into your processing by design and by default, including pseudonymization and data minimization.
• Appoint a written representative in Serbia when established outside Serbia and processing personal data of a person there, unless a listed exemption applies.
• Engage only a processor who guarantees appropriate technical, organizational and staff measures under a written processing agreement, and never let a processor act outside a controller's documented instructions.
• Maintain a record of processing activities covering your identity, the purposes, the categories of data subjects and data, the recipients including in other countries, any cross-border transfer and its safeguards, and the retention periods, and make it available to the Commissioner on request.
• Carry out a data protection impact assessment before processing likely to create high risk to a person's rights and freedoms, and consult the Commissioner first where the assessment shows the risk cannot be brought down.
• Designate a data protection officer where a government body processes personal data, where core activities require regular and systematic large-scale monitoring, or where core activities involve large-scale processing of special categories of personal data, and give that officer the independence and resources Article 58 requires.

Draft Law on Personal Data Protection, Ministry of Justice of the Republic of Serbia, public consultation opened 30 July 2026 · Read the law's page

• Under the draft, a controller may train an AI system on personal data on a legitimate-interest basis only in exceptional cases where that interest overrides the rights of data subjects.
• Under the draft, a controller operating video surveillance may keep footage for no longer than six months, and may not monitor employees' work absent narrow exceptions.
• Under the draft, a controller using a high-risk AI system must complete a data protection impact assessment and obtain the Commissioner's opinion, and must label synthetically generated or modified audio and video content.