SerbiaLaw on Personal Data Protection, rights of the data subject
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Tell a person, at the time you collect their personal data from them, your identity and contact details, the purpose and legal basis of processing, the recipients, any cross-border transfer, the retention period, and their rights.NIST Privacy FrameworkCM.AW-P1
- Where personal data was not collected from the person, give them the same information, plus its source and category, within a reasonable time and no later than when you first communicate with them or disclose the data to someone else.NIST Privacy FrameworkCM.AW-P1
- Answer a person's request to know whether you process their data, and if so give them access to it along with the purpose, categories, recipients and retention period.NIST Privacy FrameworkCT.DM-P1
- Correct a person's inaccurate personal data without undue delay on request, and let them complete incomplete data, including by providing a supplementary statement.NIST Privacy FrameworkCT.DM-P3
- Erase a person's personal data without undue delay once it is no longer necessary for its purpose, consent is withdrawn with no other ground, the person objects with no overriding ground, it was processed unlawfully, or erasure is required by law.NIST Privacy FrameworkCT.DM-P4
- Restrict processing on request while accuracy is disputed, the processing is unlawful but the person opposes erasure, you no longer need the data but the person needs it for a legal claim, or an objection is pending.NIST Privacy FrameworkCT.PO-P3
- Tell every recipient the data was disclosed to about a correction, erasure or restriction, unless that is impossible or requires disproportionate effort.NIST Privacy FrameworkCM.AW-P5
- Give a person their previously supplied personal data in a structured, commonly used, machine-readable format on request, and let them transmit it to another controller without hindrance.NIST Privacy FrameworkCT.DM-P2
- Stop processing a person's data for direct marketing, including related profiling, the moment they object, and tell them about this right clearly and separately no later than your first contact with them.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CT.DM-P3Data elements can be accessed for alteration.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
1 more
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Where a controller restricts the data subject's right of access under Article 28, it must document the factual and legal reasons for the restriction and place the documentation at the Commissioner's disposal on request. The other Articles this row cites (21 to 27, 29 to 37, 39, 40) set rights, time limits and information duties and state no record, apart from the burden of proof in Articles 21 and 22 on a request alleged to be manifestly unfounded. The row cites no scope clause, so no territorial hook is read.
- Kind
- Explicit
- As of
- Provision
- Article 28, para. 6
- Trigger
- personal_data_processing
What this law does
Article 23 requires a controller, when it collects personal data directly from a person, to give them its identity and contact details, the purpose and legal basis, the recipients, any cross-border transfer, the retention period, and their rights. Article 24 extends a fuller version of that notice to data obtained from elsewhere, due within a reasonable time and no later than the first communication with the person or the first disclosure of the data.
Article 26 gives a person the right to confirmation of whether their data are processed, access to the data, and information on the purpose, categories, recipients and retention period, while article 28 limits that access only to the extent and duration necessary and proportionate in a democratic society. Article 29 gives a right to rectification of inaccurate data and completion of incomplete data.
Article 30 gives a right to erasure on listed grounds including that the data are no longer necessary, consent has been withdrawn, the person has objected, or the processing was unlawful. Article 31 gives a right to restriction of processing while accuracy is disputed, an objection is pending, or the data are needed only for a legal claim.
Article 33 requires the controller to tell every recipient the data were disclosed to about a correction, erasure or restriction, unless that is impossible or disproportionately burdensome. Article 36 gives a right to receive previously supplied personal data in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance.
Article 37 gives an unconditional right to object to processing for direct marketing, including related profiling, requiring the controller to stop on the first objection and to flag this right clearly and separately no later than the first contact with the person.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .