SerbiaLaw on Personal Data Protection, the Commissioner, legal remedies and penalties
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the independent Commissioner for Information of Public Importance and Personal Data Protection to supervise compliance, free from external instruction, with inspection, information-demand and corrective powers.
- Expect a person in Serbia to be able to complain to the Commissioner about processing they believe violates this law, and to challenge the Commissioner's decision in an administrative dispute within 30 days.
- Expect a person to be able to authorize a privacy advocacy association to represent them in a complaint, an administrative dispute, a court action, or a damages claim.
- Expect a person in Serbia to have a court-enforceable damages claim under Article 86 for material or non-material harm from an infringement of this law, separate from a complaint to the Commissioner, with the controller liable and a processor liable only where it acted outside the controller's lawful instructions.
- Expect fines to be set case by case for an effective, proportionate and dissuasive effect, weighing the nature, gravity and duration of the violation, intent or negligence, mitigation efforts, prior violations, cooperation with the Commissioner, and the categories of data involved.
- Expect a fine of 50,000 to 2,000,000 dinars for a legal-entity controller or processor's breach of most of the act's substantive duties, smaller fixed fines for narrower violations, 5,000 to 150,000 dinars for a natural person or a responsible person, and 20,000 to 500,000 dinars for an entrepreneur, imposed as a misdemeanor sanction rather than a criminal offense.
These lines are LexLint's reading of the law's text. Also read by: Poverenik za informacije od javnog znacaja i zastitu podataka o licnosti (the Commissioner for Information of Public Importance and Personal Data Protection) (guidance, recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 95's general band (RSD 50,000 to 2,000,000) covers a legal-entity controller or processor's breach of most of the Act's substantive duties (processing principles, purpose limitation, transparency, data-subject rights, cross-border transfer, and more, enumerated across 32 clauses). Narrower violations carry smaller amounts: a separate fixed RSD 100,000 fine for a shorter list of legal-entity violations (e.g. failing to inform a recipient of special conditions, failing to give a data subject a reasoned decision); RSD 5,000 to 150,000 for a natural person or a responsible person within a legal entity, public authority, or foreign representative office; and RSD 20,000 to 500,000 for an entrepreneur. These are misdemeanor (prekrsaj) sanctions rather than Criminal Code offenses, imposed by the Commissioner directly through a prekrsajni nalog (misdemeanor order) issued during inspection, or through misdemeanor court proceedings, and are far lower than the GDPR-modelled figures used in EU member states since Serbia is not an EU jurisdiction.
- Rule
- Fixed only
- As of
- Minimum
- 50,000
- Currency
- RSD
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
Poverenik za informacije od javnog znacaja i zastitu podataka o licnosti (the Commissioner for Information of Public Importance and Personal Data Protection), which both investigates and, through a prekrsajni nalog issued at inspection or through misdemeanor court proceedings, imposes Article 95's fines
Settledness
- As of
- Guidance link
- https://poverenik.rs/h-content/uploads/2024/02/Poverenik-za-informacije-od-javnog-znacaja-Publikacija-9-poverenik.pdf
- Guidance body
- Poverenik za informacije od javnog znacaja i zastitu podataka o licnosti (the Commissioner for Information of Public Importance and Personal Data Protection)
- Open questions
- What measure of "novčanu naknadu" (monetary compensation) for "nematerijalnu štetu" (non-material damage) will a court award under Article 86 of the Zakon o zaštiti podataka o ličnosti, which states no amount or scale?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 95 makes it a misdemeanor for a legal-person controller or processor not to keep the prescribed record of processing (Article 47) or not to log processing actions (Article 48), and Article 79(1) lets the Commissioner order a controller or processor to give all information requested and to give access to all personal data and information needed. The duties themselves, their contents and the permanent keeping of the Article 47 record sit in Articles 47 and 48, which this row does not cite, so no contents or retention are given here. Article 78(1)(21) has the Commissioner keep its own internal record of violations, which is the authority's record and not a record kept by a controller. The row cites no scope clause, so no territorial hook is read.
- Kind
- Implicit
- As of
- Provision
- Article 95 (offence of not keeping the records required by Articles 47 and 48), with Article 79, para. 1, points 1 and 5 (the Commissioner's power to demand information and access)
- Trigger
- personal_data_processing
What this law does
Article 73 makes the Commissioner for Information of Public Importance and Personal Data Protection an independent state authority responsible for monitoring the law's application. Article 74 bars the Commissioner from taking instructions from anyone or holding other paid or unpaid work, public office, or political role. Article 79 gives the Commissioner inspection powers, including ordering a controller or processor to supply information, checking compliance, and warning of possible violations.
Article 82 gives a person the right to complain to the Commissioner about processing they believe breaches the law. Article 83 lets any party to the Commissioner's decision challenge it in an administrative dispute within 30 days. Article 85 lets a person authorize a privacy advocacy association to represent them in a complaint, an administrative dispute, a court action, or a damages claim.
Article 86 gives a person who suffered material or non-material damage from a breach of the law a court-enforceable right to monetary compensation from the controller, or from the processor only where it acted outside the controller's lawful instructions or its own duties under the law.
Article 87 requires fines to be set case by case for an effective, proportionate and dissuasive effect, weighing factors including the nature, gravity and duration of the violation, intent or negligence, mitigation efforts, prior violations, and cooperation with the Commissioner.
Article 95 fixes those fines as misdemeanor sanctions rather than criminal offenses: 50,000 to 2,000,000 dinars for a legal-entity controller or processor's breach of most of the act's substantive duties, a separate fixed 100,000 dinars for a shorter list of narrower violations, 5,000 to 150,000 dinars for a natural person or a responsible person within an entity, and 20,000 to 500,000 dinars for an entrepreneur, imposed by the Commissioner through a misdemeanor order or misdemeanor court proceedings.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .