Serbia

Article 3(4) of the Law on Personal Data Protection covers companies and their suppliers with no office in Serbia. It applies where the work relates to offering goods or services to people in Serbia, paid or free. It also applies where the work relates to monitoring their behaviour in Serbia. Article 44 requires you to appoint a representative in Serbia, in writing. The exemptions are narrow. Failing to appoint one is a fixed 100,000 dinar offence under Article 95(2)(4). The Commissioner can fine you for it directly, without going to court. Almost nobody complies. The Commissioner's 2025 annual report records only 22 appointment decisions from foreign companies in the whole year.

Article 64(2) treats two groups of destinations as safe by law. They are the parties to Council of Europe Convention 108, and the destinations the European Union has officially approved. The Government published the list on 1 August 2019, in Official Gazette 55/2019. Part I names 54 Convention 108 states. Part II names Guernsey, Israel, Japan, Canada (commercial organisations), the Isle of Man, New Zealand, the Faroe Islands, Jersey, and the United States 'limited to the Privacy Shield framework'. That list has never been amended. So it is out of date in both directions. It still names an American arrangement the European Court of Justice killed in July 2020. And it has never been updated to add South Korea, approved by the European Union in December 2021, or the current EU-US Data Privacy Framework of July 2023. Article 64(2) works by law rather than through the list. So the better reading is that the safe group tracks whatever the European Union currently recognises. But no Serbian authority has confirmed that in writing for the 2023 arrangement. Industry exceptions. Online gambling is a copy must stay in the country A live or copy database must sit in Serbia. Banking, insurance and payments are data can leave only if conditions are met You must notify the central bank, and it can veto. Telecoms must keep traffic data for 12 months, with no rule about where it sits. The public sector runs a State Data Centre in Kragujevac, but we could not find a legal duty to use it. We found no rule forcing data to stay in the country for health, education, securities, mapping or defence, checked 18 August 2026, medium confidence.

Article 65(2) lists the safeguards you can use with no approval. There are five. A legally binding arrangement between public authorities. The standard contract clauses drawn up by the Commissioner (Decision, Official Gazette 5/2020). Approved group-wide rules. An approved code of conduct. Or a certification. Article 65(3) covers contract terms you write yourself. Those need the Commissioner's specific approval, which must come within 60 days. Article 69 lists the narrow exceptions. Take-up is tiny. In the whole of 2025 the Commissioner approved exactly one set of group-wide rules, for ACUMATICA d.o.o. Belgrade. So either the destination is already treated as safe, or you build the safeguard yourself. There is no list of banned countries. The Government has never used its Article 64(3) power to declare a country unsafe.

The Commissioner cannot impose the large fines itself. Under Article 79(2)(9) it may fine you only by misdemeanour warrant, and only where the law sets a fixed amount. Everything else goes to the misdemeanour courts. In 2025 those courts delivered eight first-instance decisions on the Commissioner's requests. Four cases were discontinued, three of them because they had timed out. Four convictions produced one warning and three fines. Two of those were 100,000 dinars against a company, plus 10,000 against the responsible individual. One was 50,000 plus 5,000. Since 2010 the Commissioner has filed 49 criminal complaints. Prosecutors brought only two charges. Those produced one conviction, six months suspended, and one acquittal. Twenty-three complaints were dismissed and five investigations timed out. The Commissioner is Milan Marinović, elected by the National Assembly on 26 July 2019. The institution was still publishing monthly caseload figures and advertising senior vacancies in August 2026. The national computer emergency response team is still run by the telecoms regulator. The new Office for Information Security, created by the 2025 information security law, has no website we could find.

The maximum. Article 5(1)(5) of the Law on Personal Data Protection says do not keep data longer than you need it. Telecoms are unusual, because the same rules set both a minimum and a maximum. Article 128(6) of the 2010 electronic communications law requires 12 months of keeping, counted from the date of the communication. That article is still in force as a surviving fragment. Article 130(1)(4) requires destruction once that period ends. Minimums. The online gambling rulebook requires at least ten years of transaction data. After that, archived data must still be produced to the Administration within five days. The 2023 electronic communications law covers the identity check taken when a subscriber signs up. That data must be kept for the subscription and for 12 months after it ends. What happens when they clash. Article 100 of the privacy law said other laws should have been brought into line by the end of 2020. The Commissioner's 2025 report says flatly that this never happened. So people follow the specific industry law.

Personal data breach. Articles 53 and 54 of the Law on Personal Data Protection apply. Tell the Commissioner within 72 hours where there is a risk to people. Tell the affected people themselves without undue delay where the risk is high. The Commissioner received only 49 breach reports in the whole of 2025. That is very low for a country of seven million, and suggests widespread under-reporting. Cyber. Article 13 of the new Law on Information Security, Official Gazette 91/2025, covers operators of information and communication systems of special importance. They must report without delay, and at the latest within 24 hours of becoming aware. Article 14 sends banking and financial-market operators to the National Bank of Serbia. Firms supervised by the Securities Commission also report to that Commission. Article 24 sets the follow-up rhythm. Send updates every 24 hours for high and very high severity, and every three days for medium. A final report is due within 15 days of the incident ending. Under the National Bank's 2024 technology decision, a financial institution must classify an incident within 24 hours of detecting it. If it cannot, it must file an initial report anyway.

(1) Article 16. A minor who has turned 15 may consent alone to online services. Below 15 a parent must consent, and you must take reasonable steps to check that. (2) Article 68. A foreign court or administrative authority may order you to transfer or disclose personal data. Serbia recognises or enforces that order only if it rests on an international agreement. A mutual legal assistance treaty is the usual example. This mirrors the European resistance to overseas surveillance demands. It hits cloud providers with United States parents hardest. (3) The Commissioner's criminal complaints run under Criminal Code Articles 143 to 146. Those cover unauthorised interception, photography, publication and collection of personal data. They also run under Articles 299, 302, 329, 355 and 359. Conviction rates are near zero and cases often time out. But the exposure is personal. (4) Article 100 required all other laws touching personal data to be brought into line by the end of 2020. The Commissioner reports this was never done. So industry rules on video surveillance, policing and health records still sit awkwardly against the privacy law. (5) The Government's Decision of 1 August 2019 has never been amended. The Commissioner formally wrote to the Government in August 2020 asking for it to be brought into line. That was after the European Court of Justice struck down the Privacy Shield. Nothing changed.

Dated. Article 58 of the Law on Information Security, Official Gazette 91/2025, brought the law into force eight days after publication on 23 October 2025. The exception is Article 29, on ministry supervision of the Office for Information Security. That applies from 1 January 2027. Financial institutions have already absorbed the National Bank's new technology decision, which applied from 1 January 2026. A narrow exception ran to 30 June 2026, for banks that had notified a core-system migration. Powers that already exist and can be used at any time, with no consultation. The Government can replace or amend the safe-country list by decision. It can also declare a country unsafe under Article 64(3), except for parties to the Council of Europe treaty. It has never used that power. The National Bank can order a financial institution to unwind an outsourcing contract on concentration grounds. It can do that at any time, before or after the fact. Watch also for the lawful interception and record-keeping law that the 2023 electronic communications law assumed would arrive. Until it does, Serbia's record-keeping rules survive only as a fragment of a repealed statute.