Serbia. Comprehensive data protection. Act
ZZPLLaw on Personal Data Protection (Zakon o zaštiti podataka o ličnosti), Official Gazette RS No. 87/2018
In force
§1Summary
- Synopsis
Serbia's GDPR- and LED-based data protection law covering principles, rights, accountability, DPOs, breach notification and transfers, enforced by the Commissioner.
- Key themes
- Unique features
GDPR model but with low misdemeanour fines (up to RSD 2m, ~€17,000); foreign controllers targeting Serbia must appoint a local representative.
- SaaS relevance
Applies to SaaS providers offering services to or monitoring people in Serbia; local representative required.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Commissioner within 72h where feasible; individuals if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy list/SCCs (Commissioner)/BCRs
- Maximum penalty
- Up to RSD 2,000,000 (~€17,000) for legal entities
§3Dates
- Key dates
- Adopted
- In force
- Application postponed to 2019-08-21
§4Text and authority
- Text
- No authoritative text located.
- Authority
- Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)
§5Where it applies
- Domestic law of
- Serbia
§6Sources and verification
- Sources consulted
- Verification
High confidence.