Law note · Serbia
Draft Law on Personal Data Protection (2026 reform)
The Ministry of Justice published a draft replacement Law on Personal Data Protection for public consultation on 30 July 2026, with consultation running through 10 September 2026.
The draft is reported to grow from 102 to 175 articles and restructure the law into three parts, adding an explicit legitimate-interest basis for AI training in exceptional cases, a video-surveillance regime with a six-month retention cap, and new biometric-identification and cross-border-transfer regimes not present in the current 2018 act. It has not been introduced to the National Assembly and has not been adopted; this instrument is not currently binding.
What it asks of an app
- This draft is not yet law. No obligation currently attaches to it; monitor for introduction to the National Assembly and adoption.
When LexLint raises it
Declared activities: crawls_web, trains_models, high_risk_decisions, processes_voice, processes_biometrics
Primary source: IAPP news analysis, corroborated by Chambers and Partners' 2026 practice guide describing the reform as well advanced