🇷🇸Law on Personal Data Protection
Law on Personal Data Protection, Official Gazette RS No. 87/2018
The Serbian law covers automated processing and structured non-automated processing. Article 3 extends it to processing connected with an establishment in Serbia and to certain offering or monitoring directed at people who reside or stay in Serbia.
Core controller and processor duties
Lawfulness and consent: Articles 12 and 15 require a documented lawful basis and set the standard for valid consent. Article 16 sets 15 as the digital-consent age.
Transparency and rights: Articles 21-40 cover transparent handling, access, correction, erasure, restriction, portability, objection and automated decisions. The normal response period is 30 days, extendable by a further 60 days where necessary.
Accountability: Article 44 requires certain non-Serbian controllers and processors to appoint a representative. Articles 45 and 47 cover processor arrangements and records of processing. Articles 50-55 address security, 72-hour regulator notification, high-risk communication, DPIAs and prior consultation. Articles 56-58 govern DPO designation and position.
Transfers: Articles 64-69 require an applicable transfer route, such as an adequacy decision, appropriate safeguards or a limited statutory derogation.
An overseas platform profiling users in Serbia should document Article 3 applicability, appoint a Serbian representative where Article 44 requires one, localise notices and rights handling, and validate every onward international transfer.
Articles 3, 12-16 - scope, legal bases, consent and children.
Articles 21-40 - transparency and individual rights.
Articles 44-58 - representative, processors, records, security, breaches, DPIAs and DPOs.
Articles 64-69 - international transfers.