Serbia

Article 3(4) of the Law on Personal Data Protection applies it to controllers and processors with no establishment in Serbia where the processing relates to (1) offering goods or services to people in Serbia, whether or not payment is required, or (2) monitoring their behaviour in Serbia. Article 44 requires the written appointment of a representative in Serbia; the exemptions are narrow. Failure to appoint one is a fixed 100,000 dinar offence under Article 95(2)(4) that the Commissioner can fine directly by misdemeanour warrant without going to court. Compliance is very thin in practice: the Commissioner's 2025 annual report records only 22 appointment decisions from foreign companies processed in the whole year.

Article 64(2) creates a statutory presumption of adequacy for parties to Council of Europe Convention 108 and for destinations the European Union has found adequate. The Government published the list on 1 August 2019 (Official Gazette 55/2019): 54 Convention 108 states in Part I, and in Part II Guernsey, Israel, Japan, Canada (commercial organisations), the Isle of Man, New Zealand, the Faroe Islands, Jersey and the United States 'limited to the Privacy Shield framework'. That list has never been amended. It is therefore out of date in both directions: it still names an American framework the European Court of Justice killed in July 2020, and it has never been updated to add South Korea (approved by the European Union in December 2021) or the current EU-US Data Privacy Framework (July 2023). Because Article 64(2) operates by law rather than by the list, the better reading is that the presumption tracks whatever the European Union currently recognises, but no Serbian authority has confirmed this in writing for the 2023 framework. Sector overrides: online gambling is a copy must stay in the country (a production or replica database must sit in Serbia); banking, insurance and payments are data can leave with the right paperwork with a central-bank notification and veto gate; telecoms retain traffic data for 12 months with no location rule; the public sector operates a State Data Centre in Kragujevac but we could not find a statutory duty to use it. No localisation rule was found for health, education, securities, mapping or defence — checked 18 August 2026, medium confidence.

Article 65(2) lists safeguards usable without any approval: a legally binding instrument between public authorities, the standard contractual clauses drawn up by the Commissioner (Decision, Official Gazette 5/2020), approved binding corporate rules, an approved code of conduct, or a certification. Article 65(3) covers bespoke contract terms, which need the Commissioner's specific approval within 60 days. Article 69 lists the derogations. Take-up is tiny: in the whole of 2025 the Commissioner approved exactly one set of binding corporate rules (for ACUMATICA d.o.o. Belgrade). The model is an allowlist in the sense that the destination is either presumed adequate or you must build the safeguard yourself; there is no blocklist of banned countries, and the Government has never used its Article 64(3) power to declare a country inadequate.

The Commissioner cannot impose the large fines itself. Under Article 79(2)(9) it may issue a fine only by misdemeanour warrant and only where the law sets a fixed amount; everything else goes to the misdemeanour courts. In 2025 those courts delivered eight first-instance decisions on the Commissioner's requests: four proceedings were discontinued (three because they had timed out), and four convictions produced one warning and three fines — two of 100,000 dinars against a company plus 10,000 against the responsible individual, and one of 50,000 plus 5,000. Since 2010 the Commissioner has filed 49 criminal complaints; prosecutors brought only two indictments, producing one conviction (six months suspended) and one acquittal, with 23 complaints dismissed and five investigations timed out. The Commissioner is Milan Marinović, elected by the National Assembly on 26 July 2019; the institution was still publishing monthly caseload figures and advertising senior vacancies in August 2026. The national computer emergency response team is still run by the telecoms regulator; the new Office for Information Security created by the 2025 information security law has no website we could find.

Ceiling: Article 5(1)(5) of the Law on Personal Data Protection sets the storage-limitation principle. The telecoms regime is unusual in being both a floor and a ceiling — Article 128(6) of the 2010 electronic communications law (still in force as a surviving fragment) requires 12 months' retention from the date of the communication, and Article 130(1)(4) requires destruction once that period ends. Floors: the online gambling rulebook requires at least ten years of transaction data, after which archived data must still be produced to the Administration within five days. The 2023 electronic communications law requires identity-check data captured at subscriber registration to be kept for the subscription and 12 months after it ends. Where a sector floor and the privacy ceiling conflict, Article 100 of the privacy law says other laws should have been brought into line by the end of 2020 — the Commissioner's 2025 report states flatly that this never happened, so in practice the specific sector law is what people follow.

Personal data breach: Articles 53 and 54 of the Law on Personal Data Protection — notify the Commissioner within 72 hours where there is a risk to people, and notify affected individuals without undue delay where the risk is high. The Commissioner received only 49 breach notifications in the whole of 2025, which is implausibly low for a country of seven million and suggests widespread under-reporting. Cyber: Article 13 of the new Law on Information Security (Official Gazette 91/2025) requires operators of information and communication systems of special importance to report without delay and at the latest within 24 hours of becoming aware. Article 14 routes banking and financial-market operators to the National Bank of Serbia, and firms supervised by the Securities Commission also to that Commission. Article 24 sets the follow-up rhythm: every 24 hours for high and very high severity, every three days for medium, and a final report within 15 days of the incident ending. Under the National Bank's 2024 ICT decision a financial institution must classify an incident within 24 hours of detection and, if it cannot, must file an initial report anyway.

(1) Article 16: a minor who has turned 15 may consent alone to information-society services; below 15 a parent must consent and the controller must take reasonable steps to verify this. (2) Article 68: a decision of a foreign court or administrative authority requiring a controller or processor to transfer or disclose personal data may be recognised or enforced in Serbia only if based on an international agreement, such as a mutual legal assistance treaty. This is the Serbian analogue of the European resistance to overseas surveillance demands and it bites on cloud providers with United States parents. (3) The Commissioner's criminal complaints run under Criminal Code Articles 143 to 146 (unauthorised interception, photography, publication, and collection of personal data) and Articles 299, 302, 329, 355 and 359; conviction rates are near zero and cases frequently time out, but the exposure is personal. (4) Article 100 required all other laws touching personal data to be aligned by the end of 2020; the Commissioner reports this was never done, so sector rules on video surveillance, policing and health records still sit awkwardly against the privacy law. (5) The Government's Decision of 1 August 2019 has never been amended, despite the Commissioner formally writing to the Government in August 2020 asking it to be brought into line after the European Court of Justice struck down the Privacy Shield.

Dated: Article 58 of the Law on Information Security (Official Gazette 91/2025) brought the law into force eight days after publication on 23 October 2025, except Article 29 — ministry supervision of the Office for Information Security — which applies from 1 January 2027. Financial institutions have already absorbed the National Bank's new ICT decision, which applied from 1 January 2026, with a narrow carve-out running to 30 June 2026 for banks that had notified a core-system migration. Dormant switches, any of which can change the picture without consultation: the Government can replace or amend the country adequacy list by decision at any time; it can also declare a country inadequate under Article 64(3), except for parties to the Council of Europe treaty, and has never used that power; and the National Bank can order a financial institution to unwind an outsourcing contract on concentration grounds, at any time, before or after the fact. Watch also for the lawful interception and data retention law that the 2023 electronic communications law assumed would arrive — until it does, Serbia's retention regime survives only as a fragment of a repealed statute.