Serbia Law on Personal Data Protection (2018)

Why does it matter?

For a company operating in Serbia the law is the test of every personal-data process, and it reaches foreign companies that sell to or track Serbian residents (Article 3). Its duties are concrete: a record of processing activities under Article 47, security measures under Article 50, a notification to the Commissioner within 72 hours of learning of a breach that risks individuals' rights (Article 52), an impact assessment before high-risk processing (Article 54) with prior consultation of the Commissioner where the risk stays high (Article 55), and a data protection officer for public authorities and for large-scale monitoring or special-category processing (Article 56). Each omission is a misdemeanor under Article 95, with fines for legal entities of 50,000 to 2,000,000 dinars, and the Commissioner's decisions are binding and enforceable.

Key benefits include:

• A GDPR-model law with Serbian specifics

The principles, lawful bases, rights and obligations track the GDPR, so a GDPR program covers most of it, while the Commissioner's own forms, the Government's adequacy list and Serbian-language records are local requirements.

• One supervisory authority

The Commissioner for Information of Public Importance and Personal Data Protection supervises the law (Article 73), handles complaints, and must act on a complaint within 60 days or the complainant may go to the Administrative Court (Article 83).

• Fixed breach clock

Article 52 requires notice to the Commissioner without undue delay and, where possible, within 72 hours of learning of a breach, with reasons for any delay; Article 53 adds notice to data subjects when the risk is high.

• Defined transfer routes

Articles 63 to 70 set adequacy (Council of Europe Convention 108 parties and EU-recognized countries count as adequate), appropriate safeguards including standard contractual clauses drawn up by the Commissioner, binding corporate rules and the derogations in Article 69.

• Evidence the Commissioner can inspect

Records of processing (Article 47), impact assessments (Article 54), the DPO designation (Article 56) and documented security measures (Article 50) are what an inspection under Article 77 asks for.

How does it work?

Articles 1 to 11 set the subject, scope and principles. Article 3 applies the law to processing by controllers and processors established in Serbia and to foreign controllers that offer goods or services to people in Serbia or monitor their behavior. Article 5 lists lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity and confidentiality, and makes the controller responsible for demonstrating compliance. Article 12 gives the six lawful bases: consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests (the last not available to public authorities in their tasks). Article 15 sets the conditions for consent and Article 17 bans processing of special categories of data except in the listed cases.

Articles 21 to 40 are the data subject rights: transparent information in plain language (Article 21), the information to give when data are collected from the person (Article 23) or from elsewhere (Article 24), access (Article 26), rectification (Article 29), erasure (Article 30), restriction (Article 31), portability (Article 36), objection (Article 37) and protection against decisions based solely on automated processing (Article 38). Articles 41 to 58 are the controller and processor duties: appropriate technical, organizational and personnel measures (Article 41), a representative in Serbia for foreign controllers (Article 44), processor contracts (Article 45), records of processing (Article 47), security of processing (Article 50), breach notification (Articles 52 and 53), impact assessment and prior consultation (Articles 54 and 55) and the data protection officer (Articles 56 to 58).

Articles 63 to 70 govern transfers abroad: without approval to countries and organizations with an adequate level of protection, which Article 64 extends to parties to the Council of Europe Convention 108 and to countries the European Union recognizes, with the Government able to adopt its own list; otherwise with appropriate safeguards under Article 65, including standard contractual clauses drawn up by the Commissioner, binding corporate rules approved under Article 67, approved codes and certifications; and failing those, the derogations in Article 69. Articles 73 to 80 establish the Commissioner's independence and powers, Articles 82 to 86 the complaint, court and compensation routes, and Article 95 the misdemeanors: 50,000 to 2,000,000 dinars for legal entities, 20,000 to 500,000 for entrepreneurs and 5,000 to 150,000 for responsible persons.

Key Elements

• Principles and lawful bases (Articles 5 and 12)

Six principles plus accountability; six lawful bases, with legitimate interest unavailable to public authorities in their official tasks.

• Data subject rights (Articles 21 to 40)

Information, access, rectification, erasure, restriction, portability, objection and limits on solely automated decisions, delivered in plain language.

• Records and security (Articles 47 and 50)

A record of processing activities with the Article 47 contents, and security measures proportionate to risk including pseudonymization and encryption.

• Breach notification (Articles 52 and 53)

To the Commissioner within 72 hours where the breach risks individuals' rights, with the processor informing the controller without delay; to data subjects where the risk is high.

• DPIA, prior consultation and DPO (Articles 54 to 58)

Impact assessment before high-risk processing, the Commissioner's opinion where residual risk stays high, and a mandatory data protection officer for public authorities and for large-scale monitoring or special-category processing.

• Transfers and penalties (Articles 63 to 70 and 95)

Adequacy, Commissioner-issued standard contractual clauses, binding corporate rules and derogations; misdemeanor fines up to 2,000,000 dinars for legal entities.

What does it cover?

The law covers automated processing and manual processing in filing systems (Article 3), by public authorities and private organizations alike, excluding purely personal or household use. It applies to controllers and processors established in Serbia for activities carried out in Serbia, wherever the processing happens, and to foreign controllers and processors that offer goods or services to data subjects in Serbia or monitor their behavior there; those must appoint a representative in Serbia unless Article 44 exempts them. A separate set of provisions applies to processing by competent authorities for the prevention, investigation and prosecution of criminal offenses, where the Commissioner's prior-consultation and DPO rules differ (Articles 55 and 56).

What are its objectives?

Article 2 states the purpose: to protect the fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data.

Make every processing operation lawful, fair, transparent and limited to its purpose (Article 5).

Give individuals enforceable rights over their data, with the Commissioner and the courts as remedies (Articles 21 to 40, 82 to 86).

Oblige controllers and processors to document, secure and assess their processing (Articles 41 to 58).

Allow data to leave Serbia only with adequacy, safeguards or a listed derogation (Articles 63 to 70).

Give the Commissioner independent supervisory and enforcement powers (Articles 73 to 80).

Framework in Context

The law is Serbia's transposition of the EU data protection model ahead of EU accession: its structure follows the GDPR, its law-enforcement provisions follow the EU's Law Enforcement Directive, and Article 64 treats parties to the Council of Europe's Convention 108 and EU-recognized countries as adequate destinations. A controller already running a GDPR program maps its records, DPIAs, DPO and transfer tools onto the Serbian articles; ISO/IEC 27701 and the NIST Privacy Framework supply the management-system and risk structure that the law's accountability duty (Article 5) expects, and ISO/IEC 27001 controls evidence the Article 50 security measures. The Commissioner publishes the request and complaint forms and the standard contractual clauses that Article 65 refers to.

Common Framework Mappings

Organizations map the law's articles to the frameworks below so that one privacy program serves the Commissioner, EU counterparts and security auditors.

Mapped frameworks include:

CIS Controls v8.1

GDPR

HIPAA

ISO 27001:2022

ISO 27002:2022

ISO 27701

NIST CSF 2.0

NIST Privacy Framework v1.0

NIST 800-53 Rev.5

SOC 2