Law / Serbia

Law on Personal Data Protection, special categories of personal data and minors

Law on Personal Data Protection, arts. 16-19 (special categories of personal data and minors), Official Gazette RS No. 87/2018

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 21 August 2019.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process data revealing racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or process genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the person's explicit consent for one or more specified purposes.
Where a minor is 15 years old or older, their own consent is enough to process personal data for an information-society service; below that age, get consent from the parent exercising parental responsibility or another legal representative, and take reasonable steps to verify it.
Process data about a person's criminal convictions, offences, or related security measures only under the control of, or as specifically permitted by law for, a competent authority, and keep any unified register of criminal convictions solely under that authority's control.
Where a competent authority processes special categories of personal data for law-enforcement or national-security purposes, apply Article 18's narrower list of exceptions instead of Article 17's, and only where necessary and accompanied by appropriate safeguards.

What it reaches

Obligation class

Prohibition, Consent, Biometric, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 17 prohibits processing that reveals racial or ethnic origin, political opinion, religious or philosophical belief, or trade union membership, or that involves genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless one of ten listed exceptions applies, among them the person's explicit consent for one or more specified purposes, necessity under employment or social-security law, protecting vital interests where the person cannot consent, a nonprofit political, philosophical, religious or trade-union body processing only its own members' data, data the person has manifestly made public, preventive or occupational medicine, and archiving or scientific, historical or statistical research.

Article 18 applies a narrower version of the same prohibition to a competent authority processing special categories of personal data for law-enforcement or national-security purposes, permitting it only where the authority is authorized by law, the processing protects vital interests, or the data was manifestly made public by the person.

Article 19 confines processing of data on criminal convictions, offences and security measures to processing under the control of, or specifically authorized by law for, a competent authority, and keeps any unified register of criminal convictions solely under that authority's control.

Article 16 lets a minor of 15 or older give their own consent to processing personal data for an information-society service, and below that age consent must come from the parent exercising parental responsibility or another legal representative, with the controller required to take reasonable steps, considering available technology, to verify it.

Serbia has not adopted a standalone biometric-identifier statute, and the definition in article 4 and the restriction in article 17 treat biometric data as one item within this special-categories regime rather than a dedicated one.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
serves_minors
handles_health_records

Read the law

Zakon o zastiti podataka o licnosti, full consolidated statute text (paragraf.rs)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app