Serbia Law on Personal Data Protection (2018)
Serbia's Law on Personal Data Protection (Official Gazette No. 87/2018), applied since 21 August 2019 and modelled closely on the EU GDPR and the Law Enforcement Directive: six lawful bases, consent at 15 for online services, data subject rights answered within 30 days, records, DPIAs, DPOs registered with the Commissioner, 72-hour breach notification, transfers on Convention 108 or EU adequacy or Commissioner SCCs, and misdemeanour fines of 50,000 to 2,000,000 dinars. A new law is in preparation but unpublished.
Serbia Law on Personal Data Protection (2018) is a compliance framework from Serbia with 10 domains and 34 controls. The largest domains are Rights of data subjects – Serbia Law on Personal Data Protection (2018) (8 controls), Accountability: controllers and processors – Serbia Law on Personal Data Protection (2018) (4 controls), Security, breach and impact assessment – Serbia Law on Personal Data Protection (2018) (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (10)
Accountability: controllers and processors – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::42 | Build data protection by design and by default into processing |
| serbia-law-on-personal-data-protection-2018::43 | Set out joint controllers' responsibilities in a transparent arrangement |
| serbia-law-on-personal-data-protection-2018::45 | Engage processors only with sufficient guarantees under a contract with the Article 45 terms |
| serbia-law-on-personal-data-protection-2018::47 | Keep records of processing activities as controller and as processor |
Competent authorities (law enforcement processing) – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::LE | Competent authorities: lawful basis in law, category separation, logging, DPO and prior opinion for new files |
Data protection officer, codes and certification – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::56 | Appoint a DPO where required, publish the contact and register it with the Commissioner |
| serbia-law-on-personal-data-protection-2018::57 | Involve, resource and protect the DPO, and let the DPO carry out its tasks |
| serbia-law-on-personal-data-protection-2018::59 | Use approved codes of conduct and certification as compliance tools |
Principles and lawful processing – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::12 | Rely on one of the six lawful bases, with legal-obligation and public-task bases grounded in a law |
| serbia-law-on-personal-data-protection-2018::15 | Obtain provable, separable, withdrawable consent; parental consent below 15 for online services |
| serbia-law-on-personal-data-protection-2018::5 | Process lawfully, fairly and transparently, for set purposes, minimally, accurately, for limited time and securely, and be able to prove it |
Rights of data subjects – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::21 | Answer rights requests free within 30 days, extendable by 60, and help people exercise their rights |
| serbia-law-on-personal-data-protection-2018::23 | Give full privacy information at collection or within one month for indirectly obtained data |
| serbia-law-on-personal-data-protection-2018::26 | Provide access and a copy of personal data with the Article 26 information |
| serbia-law-on-personal-data-protection-2018::29 | Rectify, complete, erase and restrict on request and notify recipients |
| serbia-law-on-personal-data-protection-2018::36 | Provide data portability in a structured machine-readable format |
| serbia-law-on-personal-data-protection-2018::37 | Stop processing on objection unless compelling grounds prevail, and always for direct marketing |
| serbia-law-on-personal-data-protection-2018::38 | Avoid decisions based solely on automated processing, or give human intervention and a way to contest |
| serbia-law-on-personal-data-protection-2018::40 | Restrict rights only where a law provides and respects proportionality |
Scope and representatives – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::3 | Apply the Law to Serbian establishments and to foreign controllers targeting or monitoring people in Serbia |
| serbia-law-on-personal-data-protection-2018::44 | Foreign controllers and processors appoint a written representative in Serbia |
Security, breach and impact assessment – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::50 | Implement risk-appropriate security measures |
| serbia-law-on-personal-data-protection-2018::52 | Notify the Commissioner of a risky breach within 72 hours and document every breach |
| serbia-law-on-personal-data-protection-2018::53 | Tell affected people of a high-risk breach without undue delay |
| serbia-law-on-personal-data-protection-2018::54 | Carry out a DPIA before high-risk processing and consult the Commissioner if risk remains high |
Special categories and specific processing – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::17 | Process special-category data only under an Article 17 exception |
| serbia-law-on-personal-data-protection-2018::19 | Process criminal-conviction data only under official control or a law with safeguards |
| serbia-law-on-personal-data-protection-2018::88 | Apply the journalism, research, workplace, archiving, JMBG and religious-body rules |
Supervision, remedies and fines – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::79 | Cooperate with Commissioner inspections and comply with corrective orders |
| serbia-law-on-personal-data-protection-2018::82 | Respect data subjects' complaint, court and compensation routes |
| serbia-law-on-personal-data-protection-2018::95 | Know the misdemeanour fines: 50,000 to 2,000,000 dinars for legal entities |
Transfers – Serbia Law on Personal Data Protection (2018)
| Code | Title |
|---|---|
| serbia-law-on-personal-data-protection-2018::64 | Transfer freely to Convention 108 parties and EU-adequate destinations, or to countries on the Government list |
| serbia-law-on-personal-data-protection-2018::65 | Use Commissioner SCCs, BCRs, codes or certification, or obtain approval for bespoke clauses |
| serbia-law-on-personal-data-protection-2018::69 | Use derogations only for listed situations, and report one-off legitimate-interest transfers |
What is Serbia Law on Personal Data Protection (2018) and who does it apply to?
Serbia Law on Personal Data Protection (2018) is a compliance framework from Serbia with 10 domains and 34 controls. Serbia's Law on Personal Data Protection (Official Gazette No. 87/2018), applied since 21 August 2019 and modelled closely on the EU GDPR and the Law Enforcement Directive: six lawful bases, consent at 15 for online services, data subject rights answered within 30 days, records, DPIAs, DPOs registered with the Commissioner, 72-hour breach notification, transfers on Convention 108 or EU adequacy or Commissioner SCCs, and misdemeanour fines of 50,000 to 2,000,000 dinars. A new law is in preparation but unpublished. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Serbia Law on Personal Data Protection (2018) actually require?
Serbia Law on Personal Data Protection (2018) has 34 controls organised across 10 domains. The largest domains are Rights of data subjects – Serbia Law on Personal Data Protection (2018) (8 controls), Accountability: controllers and processors – Serbia Law on Personal Data Protection (2018) (4 controls), Security, breach and impact assessment – Serbia Law on Personal Data Protection (2018) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Serbia Law on Personal Data Protection (2018) do I already cover?
Serbia Law on Personal Data Protection (2018) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Serbia Law on Personal Data Protection (2018)?
Start your Serbia Law on Personal Data Protection (2018) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Serbia Law on Personal Data Protection (2018) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 34 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required