Serbia Official Gazette No. 87/2018 — Personal Data Protection Law
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting. Framework text may require a separate license unless explicitly provided.
Overview
Serbia Official Gazette No. 87/2018 — Personal Data Protection Law is a national data protection regulation that helps organizations safeguard personal data and ensure compliance with privacy requirements. The law establishes the principles, rights, and obligations for the processing and protection of personal data within Serbia, aligning with modern standards for data privacy.
Published by the Government of the Republic of Serbia, this law applies to both public and private sector entities that collect, use, store, or process personal data. It covers comprehensive areas including data subject rights, legal bases for processing, information security measures, breach notification, and oversight by the Commissioner for Information of Public Importance and Personal Data Protection.
Organizations achieve compliance by implementing technical and organizational security controls, conducting data protection impact assessments, and maintaining documentation to support regulatory inspections. The law forms the basis for privacy and security governance programs, facilitating risk management and aligning Serbian organizations with broader European data protection frameworks such as the GDPR.
Why it Matters
Serbia's Personal Data Protection Law establishes essential requirements for safeguarding personal information and maintaining public trust in organizational data practices.
Key benefits include:
- Improve legal compliance
Enable organizations to meet mandatory data protection obligations and mitigate the risk of regulatory penalties or enforcement actions.
- Strengthen accountability measures
Require internal documentation and processes that demonstrate how personal data is handled responsibly and transparently.
- Enhance data subject rights
Support effective mechanisms for individuals to access, correct, or erase their personal information as required by law.
- Increase audit readiness
Facilitate recordkeeping and evidence management, making it easier to demonstrate compliance during external audits or inspections.
- Promote organizational trust
Foster confidence among customers and partners by showing a clear commitment to protecting the privacy of personal data.
How it Works
The Serbia Official Gazette No. 87/2018 — Personal Data Protection Law establishes a comprehensive regulatory framework for the processing and protection of personal data. It structures its requirements around core principles such as lawfulness, transparency, data minimization, and accountability, closely aligning with the GDPR model. Key regulatory requirements address the rights of data subjects, obligations of data controllers and processors, data breach notification, and the appointment of data protection officers.
In practice, organizations implement the Personal Data Protection Law by developing and maintaining security controls, conducting regular risk assessments, and establishing clear governance structures to manage compliance. Typical activities include mapping their operational processes to legal requirements, drafting privacy notices, training staff, updating incident response plans, and maintaining records of processing activities to support ongoing monitoring and regulatory compliance.
With SmartSuite, organizations can operationalize the Personal Data Protection Law by utilizing control libraries to track compliance, leveraging risk registers to document and address data privacy risks, and managing policy governance across departments. The platform also supports evidence collection, compliance tracking, remediation workflows, and dashboard reporting, helping organizations maintain audit readiness and demonstrate accountability in data protection practices.
Key Elements
- Personal Data Processing Principles
Defines core principles for lawful, transparent, and fair processing of personal data.
- Data Subject Rights Management
Establishes procedures for recognizing and enabling individuals' rights regarding their personal data.
- Controller and Processor Obligations
Specifies duties and responsibilities for organizations handling and safeguarding personal data.
- Data Protection Impact Assessments
Outlines requirements for evaluating privacy risks and implementing mitigating measures before processing activities.
- Supervisory Authority Oversight
Describes the powers and competencies of the national data protection authority to monitor compliance.
- Cross-Border Data Transfer Mechanisms
Details mechanisms for the lawful international transfer and sharing of personal data.
Framework Scope
Serbia Official Gazette No. 87/2018 — Personal Data Protection Law is adopted by entities processing personal data within Serbia, including public authorities and private organizations. It governs all personal data processing activities in both digital and paper formats, and is typically implemented to comply with regulatory mandates and enhance data protection governance and privacy management programs.
Framework Objectives
Serbia Official Gazette No. 87/2018 — Personal Data Protection Law defines standards for safeguarding personal data and ensuring regulatory compliance.
Safeguard individuals' personal data through effective security controls and measures
Strengthen organizational governance and accountability for data processing activities
Enhance compliance with privacy regulations and national data protection requirements
Promote transparency in data management and risk management practices
Support audit readiness by maintaining records and demonstrating lawful data processing
Reduce cybersecurity risk and improve operational resilience in handling sensitive information
Framework in Context
Serbia's Personal Data Protection Law (Official Gazette No. 87/2018) aligns closely with the EU GDPR and shares key principles with frameworks like ISO/IEC 27701 and OECD Privacy Guidelines. Organizations typically implement this law to achieve regulatory compliance, especially when processing the personal data of Serbian residents or operating within Serbia's jurisdiction.
Common Framework Mappings
Serbia's Personal Data Protection Law is often mapped to international frameworks for streamlined compliance, cross-border data protection, and harmonized privacy practices in organizations operating or partnering globally.
Mapped frameworks include:
CIS Critical Security Controls
EU GDPR
HIPAA
ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27701
NIST Cybersecurity Framework
NIST Privacy Framework
NIST SP 800-53
SOC 2
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentLawSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionEuropeRegion DetailRepublic of SerbiaPublisherJavno preduzeće Službeni glasnik (Službeni glasnik Republike Srbije — the Public Enterprise Official Gazette of the Republic of Serbia) ([slglasnik.com](https://www.slglasnik.com/node/1837?utm_source=openai))
- VersioningVersion2018Effective DateAugust 21, 2019Issue Date13 November 2018
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
Serbia's Personal Data Protection Law (Official Gazette No. 87/2018) is published by the Republic of Serbia and is publicly available via the Official Gazette and government websites.License included with platform
How SmartSuite Supports SAMA CSF
Manage Saudi Arabia SAMA Cybersecurity Framework (v1.0) by organizing financial sector security controls, tracking implementation across systems, and maintaining evidence supporting regulatory compliance and operational resilience.
Financial Control Framework Library
Structure SAMA control domains with ownership, scope, and implementation status across systems.
Risk Assessment and Regulatory Mapping
Link cybersecurity risks to SAMA controls and financial regulatory requirements.
Policy and Governance Management
Centralize security policies, standards, and approvals aligned to SAMA expectations.
Identity, Access, and Security Operations
Manage authentication, privileged access, monitoring, and operational controls across environments.
Incident Response and Threat Management
Track incidents, investigations, and response workflows aligned to financial sector requirements.
Compliance Monitoring and Audit Reporting
Provide dashboards showing control coverage, risk posture, and readiness for SAMA audits.
Related frameworks
GDPR is an EU regulation that protects individuals' personal data and strengthens organizations' accountability for privacy.
ISO/IEC 27001:2022 is an international ISMS standard that helps organizations manage information security risks and protect data.
ISO/IEC 27018 provides guidelines for protecting personally identifiable information processed in public cloud services.
ISO/IEC 27701 extends ISO/IEC 27001 to help organizations manage privacy and protect personally identifiable information.
Frequently Asked Questions For Serbia Official Gazette No. 87/2018 — Personal Data Protection Law
The Serbia Personal Data Protection Law establishes the legal framework for safeguarding personal data in Serbia. Its purpose is to regulate the collection, processing, and storage of personal data to protect individual privacy rights and ensure data is handled lawfully.
Yes, compliance with the Serbia Personal Data Protection Law is mandatory for all data controllers and processors operating within Serbia, or handling the personal data of Serbian citizens. Non-compliance can result in significant penalties and legal actions enforced by the Commissioner for Information of Public Importance and Personal Data Protection.
The law applies to any organization, public or private, that collects, processes, or stores personal data within Serbia. It also covers organizations outside Serbia if they process the personal data of Serbian residents in connection with goods, services, or monitoring behavior within Serbia.
Key requirements include obtaining valid consent from data subjects, ensuring transparency in data processing, implementing adequate technical and organizational security measures, and maintaining records of processing activities. Organizations must also designate a Data Protection Officer (DPO) in certain circumstances and conduct Data Protection Impact Assessments (DPIAs) for high-risk processing.
Implementation involves identifying all personal data processing activities, mapping data flows, and establishing data protection policies and procedures. Organizations must also train employees on data privacy, implement security controls, and set up mechanisms to handle data subject requests and breaches.
The Serbia Personal Data Protection Law is closely aligned with the GDPR, incorporating similar principles, rights, and obligations for data controllers and processors. However, there are some local adaptations and differences, so organizations should review both frameworks for full compliance if operating across jurisdictions.
Ongoing compliance includes regular updates to data processing records, continuous risk assessments, staff training, monitoring security measures, and timely response to data subject requests and incidents. Annual reviews and updates to policies and procedures are also recommended to address evolving legal and operational requirements.
SmartSuite helps organizations manage compliance with the Serbia Personal Data Protection Law by providing modules for risk tracking, control management, and centralized evidence collection. It enables automated audit readiness workflows, reporting dashboards, and streamlined documentation to demonstrate alignment with legal requirements and support regulatory inspections.
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.