🇷🇸Serbia

Serbia has a GDPR-aligned national data protection law

Serbia's Law on Personal Data Protection, Official Gazette RS No. 87/2018, has applied since 22 August 2019. It regulates private-sector and public-authority processing, including qualifying offers to or monitoring of people in Serbia by organisations established abroad. The Commissioner for Information of Public Importance and Personal Data Protection supervises the law.

Operational points

The law requires a lawful basis, transparent notices, processor terms, records of processing, appropriate security, impact assessments for high-risk processing, designated data protection officers in specified cases and compliant international-transfer mechanisms. A regulator breach notice is generally due within 72 hours, while affected people must be told without undue delay where the breach is likely to create a high risk.

A child may consent to an information-society service from age 15. Controllers outside Serbia may need a Serbian representative. Rights requests normally must be answered within 30 days and can be extended by a further 60 days where justified.