Law / Serbia

Law on Personal Data Protection

Zakon o zastiti podataka o licnosti (Law on Personal Data Protection) Official Gazette RS No. 87/2018, arts. 1-15, 20, 41-51, 54-62, 88-94 (general provisions, principles, lawful basis, controller and processor obligations, data protection impact assessment, data protection officer, and special processing cases)

In force since 22 Aug 2019.

A comprehensive regime rule binding public and private bodies.

How the hook was established: express
What makes it apply: Operator establishment, Market targeting, User location, Data subject residence
Obligation class: Consent, Security, Retention, Governance, DPIA
Audit expectation: on_request
Who audits it: Regulator
Where the report goes: Produced on request

What it requires

Have one of the lawful grounds Article 12 lists, such as consent, contract necessity, legal obligation, vital interest, public interest, or legitimate interest, before processing personal data of a person in Serbia.NIST Privacy FrameworkCT.PO-P1
Take consent only where you can demonstrate it was given, present a bundled consent request separately from other matters in plain, simple language, and let the person withdraw consent at any time as easily as they gave it.NIST Privacy FrameworkCT.PO-P1
Take appropriate technical, organizational and staff measures proportionate to the processing's risk, keep them under review, and be able to demonstrate compliance.NIST Privacy FrameworkGV.MT-P3
Build data protection into your processing by design and by default, including pseudonymization and data minimization.NIST Privacy FrameworkGV.PO-P2
Appoint a written representative in Serbia when established outside Serbia and processing personal data of a person there, unless a listed exemption applies.NIST Privacy FrameworkGV.PO-P5
Engage only a processor who guarantees appropriate technical, organizational and staff measures under a written processing agreement, and never let a processor act outside a controller's documented instructions.NIST Privacy FrameworkID.DE-P3
Maintain a record of processing activities covering your identity, the purposes, the categories of data subjects and data, the recipients including in other countries, any cross-border transfer and its safeguards, and the retention periods, and make it available to the Commissioner on request.NIST Privacy FrameworkID.IM-P4
Carry out a data protection impact assessment before processing likely to create high risk to a person's rights and freedoms, and consult the Commissioner first where the assessment shows the risk cannot be brought down.NIST Privacy FrameworkID.RA-P4 NIST Privacy FrameworkGV.PO-P5
Designate a data protection officer where a government body processes personal data, where core activities require regular and systematic large-scale monitoring, or where core activities involve large-scale processing of special categories of personal data, and give that officer the independence and resources Article 58 requires.NIST Privacy FrameworkGV.PO-P3

These lines are LexLint's reading of the law's text. Also read by: Commissioner for Information of Public Importance and Protection of Personal Data of Serbia (Poverenik za informacije od javnog znacaja i zastitu podataka o licnosti) (guidance, recorded 20 October 2026).

In the frameworks

NIST Privacy Framework

ID.IM-P4Data actions of the systems/products/services are inventoried.
ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.

2 more

GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.

NIST CSF 2.0

GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Who enforces it

Settledness

As of: 20 October 2026
Guidance link: https://poverenik.rs/h-content/uploads/2026/01/Poverenik-za-informacije-od-javnog-znacaja-Publikacija-11-knjizni-blok.pdf
Guidance body: Commissioner for Information of Public Importance and Protection of Personal Data of Serbia (Poverenik za informacije od javnog znacaja i zastitu podataka o licnosti)
Open questions: Does "praćenje aktivnosti lica na koje se podaci odnose" ("monitoring the activities of the data subject") in Article 3 reach a controller with no seat in Serbia that collects publicly posted data about people resident in Serbia?

What it makes you log

Who may demand the log

Regulator

What the log must hold

Event time, Actor identity, Access record

Logging duty

Article 47 requires a controller or representative, and a processor, to keep a written or electronic record of processing activities with the controller's details, purposes, categories of data subjects and data, recipients, transfers and erasure periods, kept permanently (trajno) and made available to the Commissioner on request; it does not apply to a business with fewer than 250 employees unless the processing is risky, regular or touches special categories. Article 48 requires a competent authority processing for special purposes to log entry, alteration, consultation, disclosure including transfer, combination and erasure in automated systems, and the consultation and disclosure entries must show the reason, the date and time and, where possible, who consulted or disclosed and who received. Article 15(1) adds that a controller relying on consent must be able to show it was given. Article 48(3) limits use of the log to checking lawfulness, internal supervision, integrity and security and criminal proceedings. The permanent keeping in Article 47 sets no period in years, so no retention figure is given.

Kind: Explicit
As of: 28 October 2026
Provision: Article 47 (record of processing activities), Article 48 (logs of processing actions where a competent authority processes for special purposes), with Article 15(1) (the controller must be able to show consent) and Article 41(1) (the controller must be able to show compliance)
Trigger: personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 1 sets out the law's subject matter as the right to protection of natural persons in relation to personal data processing, the free flow of such data, the principles of processing, the rights of the data subject, the duties of controllers and processors, codes of conduct, transfer of personal data to other states, and the powers of the Commissioner.

Article 3 applies the law to processing carried out wholly or partly by automated means and to non-automated processing that forms part of, or is intended for, a filing system, covering a controller or processor established in Serbia and, extraterritorially, a foreign controller or processor that offers goods or services to a person in Serbia or monitors their behavior there, and it exempts only processing by a natural person for purely personal or household purposes.

Article 12 permits processing only on one of six grounds, consent, contract necessity, legal obligation, vital interest, public interest or official authority, or legitimate interest, with legitimate interest unavailable to a public authority acting within its remit and weighed with particular care where the person is a minor.

Article 15 requires a controller to be able to demonstrate that consent was given, present a bundled consent request separately from other matters in plain and simple language, and let the person withdraw consent at any time as easily as they gave it. Article 41 makes the controller responsible for appropriate technical, organizational and staff measures proportionate to the risk and able to demonstrate compliance.

Article 42 requires data protection by design and by default, including pseudonymization and data minimization.

Article 44 requires a controller or processor established outside Serbia to appoint a written representative in Serbia unless a listed exemption applies, articles 45 and 46 require a written processing agreement before engaging a processor and bar a processor from acting outside the controller's instructions, and article 47 requires a record of processing activities covering the controller's identity, the purposes, the categories of data and data subjects, the recipients including abroad, any cross-border transfer and its safeguards, and the retention periods.

Article 54 requires a data protection impact assessment before processing likely to create high risk to a person's rights and freedoms. Article 55 requires the controller to consult the Commissioner first where the assessment shows the risk cannot be brought down.

Articles 56 to 58 require a data protection officer where a government body processes personal data, where core activities require regular and systematic large-scale monitoring, or where core activities involve large-scale processing of special categories of personal data, and set the officer's independence, resourcing and minimum duties, and articles 59 to 62 let industry bodies adopt codes of conduct and establish a data-protection certification scheme.

Articles 88 to 94 carve out narrower rules for processing in journalistic, artistic or literary expression, access to information of public importance, the unique personal identification number, employment, archiving and scientific, historical or statistical research, a religious community's own rules, and humanitarian fundraising.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.