SerbiaLaw on Electronic Communications, Notification of Security and Integrity Breaches to the Regulator
Zakon o elektronskim komunikacijama ("Sl. glasnik RS", br. 35/2023), čl. 157(5)-(7) i 169
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds the same business entities as the Law's security-and-integrity row, those providing public electronic communications networks or services (reached by declaring that you provide telecom services).
- Notify the Regulator without delay of every breach of security and integrity of your public networks or services that significantly affected their operation, in accordance with the information security rules; the Law states no numeric clock (art. 157(5)).
- Expect to inform the public of the breach if the Regulator requires it, when the Regulator finds disclosure in the public interest (art. 157(6)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 169(1)(47) fines a legal person 500,000 to 2,000,000 dinars for a misdemeanor of not acting in accordance with Article 157 on the security, integrity and continuity of public networks and services.
- Rule
- Fixed only
- As of
- Minimum
- 500,000
- Currency
- RSD
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
Regulatorno telo za elektronske komunikacije i poštanske usluge (RATEL), the Regulatory Body for Electronic Communications and Postal Services
Settledness
- As of
- Open questions
- Has the Regulator's rulebook on the notification procedure under article 157(7) been adopted?
What this law does
Article 157(5) requires a business entity to notify the Regulator without delay of every breach of security and integrity of public electronic communications networks and services that significantly affected its operation. Article 157(6) authorizes the Regulator to inform the public of such a breach, or to require the operator to do so, when it finds disclosure to be in the public interest.
Article 169 fines a legal person 500,000 to 2,000,000 dinars for a misdemeanor of not acting in accordance with Article 157.
When LexLint raises it
When your app profile says your app provides telecom services.