SerbiaDraft Law on Personal Data Protection (2026 reform)
A published draft that has not reached a legislature, dated , as of .
A comprehensive regime rule binding public and private bodies.
Where it has got to
The text described here is Nacrt zakona o zaštiti podataka o ličnosti (Draft Law on Personal Data Protection), as published for public consultation, published .
Locally, this stage is javna rasprava (public consultation).
The stage above is recorded at mpravde.gov.rs.
The Ministry of Justice held the public consultation from 30 July to , with a round table on . The Government has not adopted a bill for the National Assembly.
What it requires
- Under the draft, a controller may train an AI system on personal data on a legitimate-interest basis only in exceptional cases where that interest overrides the rights of data subjects.NIST Privacy FrameworkCT.PO-P1
- Under the draft, a controller operating video surveillance may keep footage for no longer than six months, and may not monitor employees' work absent narrow exceptions.NIST Privacy FrameworkCT.DM-P5NIST Privacy FrameworkCT.PO-P1
- Under the draft, a controller using a high-risk AI system must complete a data protection impact assessment and obtain the Commissioner's opinion, and must label synthetically generated or modified audio and video content.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
The Ministry of Justice published a draft replacement Law on Personal Data Protection for public consultation on , with consultation running through .
The draft is reported to grow from 102 to 175 articles and restructure the law into three parts, adding an explicit legitimate-interest basis for AI training in exceptional cases, a video-surveillance regime with a six-month retention cap, and new biometric-identification and cross-border-transfer regimes not present in the current 2018 act.
When LexLint raises it
When your app profile says your app trains models, generates audio with AI, generates video with AI or processes personal data.
Back to the example · Lint your app
Page updated .