Processes biometric data, in Serbia

Law on Personal Data Protection, arts. 16-19 (special categories of personal data and minors), Official Gazette RS No. 87/2018 · Read the law's page

• Do not process data revealing racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or process genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the person's explicit consent for one or more specified purposes.
• Where a minor is 15 years old or older, their own consent is enough to process personal data for an information-society service; below that age, get consent from the parent exercising parental responsibility or another legal representative, and take reasonable steps to verify it.
• Process data about a person's criminal convictions, offences, or related security measures only under the control of, or as specifically permitted by law for, a competent authority, and keep any unified register of criminal convictions solely under that authority's control.
• Where a competent authority processes special categories of personal data for law-enforcement or national-security purposes, apply Article 18's narrower list of exceptions instead of Article 17's, and only where necessary and accompanied by appropriate safeguards.

Ministry of Justice of the Republic of Serbia, draft published for public consultation 30 July 2026 (consultation closes 10 September 2026)

• This measure is proposed and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Train AI on personal data under a legitimate-interest legal basis only in exceptional cases where that interest overrides data subject rights.
• Cap video-surveillance data retention at six months.
• Comply with restrictions on workplace video monitoring.