Provides telecom services, in Serbia

Zakon o elektronskim komunikacijama ("Sl. glasnik RS", br. 35/2023), čl. 157(1)-(4) i 169 · Read the law's page

• This binds a business entity (privredni subjekt) that provides public electronic communications networks or services under the Law on Electronic Communications, regulated by the Regulatory Body for Electronic Communications and Postal Services (RATEL) (art. 157; reached by declaring that you provide telecom services).
• Apply adequate technical and organizational measures, proportionate to the existing risks, to ensure the security and integrity of public networks and services, including measures to prevent and minimize the impact of security incidents on users and interconnected networks and to keep services running (art. 157(1)).
• Where there is a special risk of breach of security and integrity, tell your users of the risk and, if it is beyond the measures you must apply, of the possible protective measures and their costs (art. 157(3)).
• Give the Regulator the data it requests to assess the security and integrity of your networks and services, and submit to an extraordinary inspection after a significant breach (art. 157(8)).

Zakon o elektronskim komunikacijama ("Sl. glasnik RS", br. 35/2023), čl. 157(5)-(7) i 169 · Read the law's page

• This binds the same business entities as the Law's security-and-integrity row, those providing public electronic communications networks or services (reached by declaring that you provide telecom services).
• Notify the Regulator without delay of every breach of security and integrity of your public networks or services that significantly affected their operation, in accordance with the information security rules; the Law states no numeric clock (art. 157(5)).
• Expect to inform the public of the breach if the Regulator requires it, when the Regulator finds disclosure in the public interest (art. 157(6)).

Zakon o informacionoj bezbednosti ("Sl. glasnik RS", br. 91/2025), čl. 13-14, 24-25 · Read the law's page

• Notify the single incident-reporting system, through the Ministry's or the Office for Information Security's website, of an incident that may significantly disrupt information security, without delay and at the latest within 24 hours of becoming aware of it.
• If you operate a banking or financial-market ICT system, send that notification to the National Bank of Serbia, and also to the Securities Commission if it supervises you; if you provide an electronic-communications or postal service, send it to the Regulatory Body for Electronic Communications and Postal Services instead.when it serves a financial business
• Notify the users of your service, without delay, of an incident that causes or may cause a harmful effect on providing or using your service, together with any measures they can take to reduce or remove the harmful effect.
• While the incident continues, submit a status report to the single incident-reporting system every three days for a medium-level incident, or every 24 hours for a high or very high-level incident.
• Submit a final report within 15 days after the incident ends, covering its type, cause, duration, scope of impact, any cross-border effect, and the steps you took to remedy it.
• Report a near-miss that constitutes a serious threat, and submit an annual statistical return covering all incidents and near-misses in your ICT system to the National CERT authority by 28 February of the following year.
• This duty reaches the same priority and important ICT system operators as this law's security-measures duty, including a business that provides an information society service under Serbia's e-commerce law.