SerbiaLaw on Personal Data Protection, transfer of personal data to other states
Law on Personal Data Protection arts. 63-72 (transfer of personal data to other states and international organizations), Official Gazette RS No. 87/2018
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Transfer personal data outside Serbia freely only to a country, part of a country, sector, or international organization the Commissioner has found to ensure an adequate level of protection, a status presumed for parties to the Council of Europe's Convention 108 on automatic processing of personal data.
- Absent an adequacy finding, transfer only where you have put in place appropriate safeguards, such as standard contractual clauses issued by the Commissioner, a legally binding instrument between authorities, or Commissioner-approved binding corporate rules, and only where the person retains enforceable rights and effective legal remedies.
- Get the Commissioner's approval for binding corporate rules before relying on them, showing they legally bind every group member and its employees and expressly grant the person enforceable rights.
- Do not recognize or comply with a foreign court's or authority's order to transfer or disclose personal data unless it rests on an international agreement, such as a mutual legal assistance treaty between Serbia and that country.
- Absent an adequacy finding or safeguards, transfer personal data only under a listed derogation, such as the person's explicit and informed consent to the transfer, or necessity for a contract or an important public interest.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Decision basis
Logging duty
Where a competent authority processing for special purposes transfers data to a state without an adequacy finding on its own assessment of safeguards, Article 66(3) requires it to document the transfer and make the documentation available to the Commissioner on request, and Article 66(4) says the documentation holds the date and time, the receiving authority, the reasons and the data transferred. Article 69 requires a controller or processor relying on a listed derogation for a transfer to keep evidence of its assessment and safeguards in the Article 47 record of processing, and Articles 70 and 71 require a competent authority to document certain other transfers. The documentation items other than the date and time and the reasons are not listed log contents. The row cites no scope clause, so no territorial hook is read.
- Kind
- Explicit
- As of
- Provision
- Article 66, paras. 3 and 4, with Articles 69(3), 70 and 71
- Trigger
- personal_data_processing
What this law does
Article 64 permits a transfer to another country, part of its territory, a sector of activity there, or an international organization without prior approval where an adequate level of protection has been found, a status presumed for parties to the Council of Europe's Convention on the protection of individuals with regard to automatic processing of personal data.
Article 65 lets a controller or processor transfer personal data absent an adequacy finding only where it has put in place appropriate safeguards, such as a legally binding instrument between authorities, standard contractual clauses issued by the Commissioner, or binding corporate rules, and only where the person retains enforceable rights and effective legal remedies.
Article 67 requires the Commissioner to approve binding corporate rules before they may be relied on, checking that they bind every group member and its employees and expressly grant the person enforceable rights. Article 68 bars recognizing or enforcing a foreign court's or administrative authority's order to transfer or disclose personal data in Serbia unless it rests on an international agreement, such as a mutual legal assistance treaty between Serbia and that state.
Absent an adequacy finding or safeguards, article 69 allows a transfer only under a listed derogation, including the person's explicit consent given after being informed of the risks, necessity for a contract with or in the interest of the person, or an important public interest defined by Serbian law.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .