Understanding Serbia’s law on data protection and privacy
Serbia’s privacy framework is built around the Law on Protection of Personal Data, known locally as the Zakon o zaštiti podataka o ličnosti. It broadly follows the European Union’s General Data Protection Regulation (GDPR), although Serbia is not an EU member state. For Australian businesses, researchers and community organisations dealing with Serbian residents, this creates a familiar but distinct compliance environment.
Personal data includes information that identifies, or could reasonably identify, a person. Names, email addresses, identification numbers, location data, device identifiers, photographs and online account details can all fall within the rules. The law also provides stronger protection for sensitive information, including health, biometric, genetic, religious and political data.
The framework matters to organisations of every size. A Belgrade charity, a Serbian online retailer, an Australian university collecting information from Serbian students and a software provider processing customer records may all need to consider their responsibilities. Nomcentar’s work illustrates why accessible legal education is valuable when privacy rights intersect with everyday civic participation.
| Area | Serbia | Australia |
|---|---|---|
| Main framework | Law on Protection of Personal Data | Privacy Act 1988 and Australian Privacy Principles |
| Supervisory authority | Commissioner for Information of Public Importance and Personal Data Protection | Office of the Australian Information Commissioner |
| Core approach | GDPR-aligned principles and individual rights | APP-based privacy obligations, with sector-specific rules |
| Data breach response | Notification may be required without undue delay | Notifiable Data Breaches scheme, generally within 30 days of awareness |
| International transfers | Safeguards or recognised legal grounds are required | Cross-border disclosure duties under APP 8 |
Who must follow the Serbian rules
The Serbian law applies to controllers, which decide why and how personal data is used, and processors, which handle information on a controller’s behalf. An employer deciding how to manage staff files is a controller. A cloud provider storing those files may be a processor. Contracts should clearly divide their duties, security responsibilities and instructions.
The rules generally cover processing carried out by organisations established in Serbia. They can also reach organisations outside Serbia where their activities involve offering goods or services to people in Serbia or monitoring their behaviour there. An Australian company selling products to customers in Novi Sad or tracking Serbian users through an online platform should therefore assess its territorial connection rather than assume distance removes its obligations.
Small organisations are not automatically outside the law. A community group collecting volunteer details, a medical practice in Kragujevac and a local sporting club may process less information than a bank, but they still need a lawful basis, reasonable security and transparent notices. The scale of the activity affects risk and proportionality, not whether privacy matters at all.
The principles behind lawful processing
Personal data must be processed lawfully, fairly and transparently, for specific and legitimate purposes. Organisations should collect only information that is relevant and limited to what they need. Keeping every document indefinitely “just in case” can conflict with purpose limitation and storage requirements.
Accuracy is another core expectation. A Serbian employer should provide a way for workers to correct outdated contact details, while an Australian company serving Serbian customers should avoid relying on old identity or delivery records. Data should be protected against unauthorised access, accidental loss and unlawful alteration through suitable technical and organisational measures.
A lawful basis is required before processing begins. Consent is one option, but it must be informed, specific and freely given, and it should be possible to withdraw it. Other grounds may include performing a contract, complying with a legal obligation, protecting vital interests, carrying out a task in the public interest or pursuing a legitimate interest that does not override the person’s rights.
Individual rights and practical requests
People can ask whether an organisation holds their personal data and request access to it. They may also seek correction of inaccurate records, deletion in appropriate circumstances, restriction of processing and data portability where the legal conditions apply. Objections can be important where information is used for direct marketing or certain legitimate-interest activities.
Organisations should create a consistent process for verifying identity, recording requests and responding within the applicable timeframe. A request might come from a Belgrade resident wanting a social media platform to remove an obsolete phone number, or from a Serbian customer in Perth asking an overseas retailer for a copy of their account data.
The right to deletion is not unlimited. Records may need to be retained to comply with tax, employment, health or litigation obligations. Similarly, access can be limited where disclosure would affect the rights of another person or reveal protected information. Clear explanations are preferable to simply refusing a request.
Automated decision-making and profiling deserve particular care. Credit scoring, targeted advertising and recruitment software can produce significant effects without meaningful human review. Controllers should explain the logic and consequences of relevant processing and examine whether bias, inaccurate data or excessive surveillance is creating unfair outcomes.
Sensitive information, children and online services
Special categories of personal data receive enhanced protection. Health details, fingerprints, facial templates, genetic information, political opinions and religious beliefs should be collected only where a specific legal condition applies. A fitness app, health service or community program should minimise access and avoid sending sensitive records through ordinary unprotected email.
Children require careful treatment because they may not fully understand long-term consequences. Age verification, parental authorisation where appropriate, simple privacy notices and child-friendly defaults can reduce risk. An app promoted to families in Sydney but collecting information from Serbian users should consider both Serbian requirements and Australian expectations around young people’s data.
Cookies and online identifiers should be reviewed according to their purpose. Essential security or service functions may be treated differently from advertising trackers, behavioural profiling tools and third-party analytics. A website should explain what it collects, why it collects it and how users can exercise their rights, rather than hiding significant practices in dense legal language.
Digital gambling, shopping and comparison websites demonstrate the issue clearly. A privacy review of a gambling comparison example would need to consider registration details, payment information, device identifiers, advertising cookies, age checks and responsible-gambling records. The commercial subject does not remove the need for data minimisation and transparent processing.
Security incidents and international transfers
Controllers and processors must use security measures proportionate to the risks. Access controls, multi-factor authentication, encryption, staff training, secure backups and tested incident procedures are practical safeguards. A small organisation may not need the same infrastructure as a national bank, but it should still know who can access personal data and what happens when an account is compromised.
When a personal data breach occurs, the organisation should assess what happened, whose information was affected and the likely risk to individuals. Where notification to the Serbian Commissioner is required, it should be made without undue delay and generally within the legal timeframe. People affected may also need to be informed, particularly when the incident creates a serious risk to their rights.
International transfers require a separate assessment. Serbia is outside the EU and European Economic Area, so information sent to a cloud provider in Germany, an analytics service in the United States or a support team in Australia should not be treated as an ordinary domestic disclosure. The organisation needs an applicable transfer mechanism, suitable contractual safeguards and an assessment of the destination’s practical protections.
Australian organisations should compare Serbian obligations with the Privacy Act 1988 and the Australian Privacy Principles. Australia’s APP 8 addresses overseas disclosure, while the Notifiable Data Breaches scheme creates its own reporting duties. If the same incident affects people in both Serbia and Australia, separate notification tests may apply.
Oversight, accountability and help
Serbia’s supervisory authority is the Commissioner for Information of Public Importance and Personal Data Protection. The Commissioner can receive complaints, conduct oversight and issue decisions or measures. Individuals may complain when an organisation ignores an access request, uses data without a valid basis or fails to respect other privacy rights.
Larger or higher-risk processing may require a data protection officer, especially for public authorities, systematic monitoring or extensive processing of sensitive information. Even where a formal officer is not mandatory, assigning a responsible person improves accountability. A processing register, privacy notices, retention schedule and breach log can provide useful evidence that the organisation has taken compliance seriously.
Australian organisations should document their role, data flows, legal bases, suppliers and transfer arrangements before launching a service for Serbian users. A business in Melbourne or Brisbane may need a Serbian-facing notice, a processor agreement and a way to handle requests in a language users can understand. Clear records also help when dealing with regulators, customers or community partners.
Privacy questions can involve employment law, consumer protection, telecommunications rules and sector-specific requirements. Community groups seeking practical guidance can use Nomcentar’s contact page to find an appropriate point of contact. Legal advice is especially important where processing involves health information, children, biometric identifiers, large-scale monitoring or international data transfers.