Makes employment decisions, in Serbia

Law on Personal Data Protection, art. 38 (automated individual decisions), Official Gazette RS No. 87/2018 · Read the law's page

• Do not base a decision producing legal effects or significantly affecting a person solely on automated processing, including profiling, unless it is necessary for a contract with them, authorized by law with adequate safeguards, or based on their explicit consent, and even then give them the right to obtain human intervention, express their view, and contest the decision.

Law on Personal Data Protection, arts. 21-37, 39-40 (rights of the data subject), Official Gazette RS No. 87/2018 · Read the law's page

• Tell a person, at the time you collect their personal data from them, your identity and contact details, the purpose and legal basis of processing, the recipients, any cross-border transfer, the retention period, and their rights.
• Where personal data was not collected from the person, give them the same information, plus its source and category, within a reasonable time and no later than when you first communicate with them or disclose the data to someone else.
• Answer a person's request to know whether you process their data, and if so give them access to it along with the purpose, categories, recipients and retention period.
• Correct a person's inaccurate personal data without undue delay on request, and let them complete incomplete data, including by providing a supplementary statement.
• Erase a person's personal data without undue delay once it is no longer necessary for its purpose, consent is withdrawn with no other ground, the person objects with no overriding ground, it was processed unlawfully, or erasure is required by law.
• Restrict processing on request while accuracy is disputed, the processing is unlawful but the person opposes erasure, you no longer need the data but the person needs it for a legal claim, or an objection is pending.
• Tell every recipient the data was disclosed to about a correction, erasure or restriction, unless that is impossible or requires disproportionate effort.
• Give a person their previously supplied personal data in a structured, commonly used, machine-readable format on request, and let them transmit it to another controller without hindrance.
• Stop processing a person's data for direct marketing, including related profiling, the moment they object, and tell them about this right clearly and separately no later than your first contact with them.

Ministry of Justice of the Republic of Serbia, draft published for public consultation 30 July 2026 (consultation closes 10 September 2026)

• This measure is proposed and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Train AI on personal data under a legitimate-interest legal basis only in exceptional cases where that interest overrides data subject rights.
• Cap video-surveillance data retention at six months.
• Comply with restrictions on workplace video monitoring.

Working Group draft under the Ministry of Science, Technological Development and Innovation; reported near-final and slated for public discussion mid-July 2026, not yet tabled in the National Assembly as of this review