Law on Personal Data Protection, rights of the data subject

Law on Personal Data Protection, arts. 21-40 (rights of the data subject), Official Gazette RS No. 87/2018

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 21 August 2019.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Tell a person, at the time you collect their personal data from them, your identity and contact details, the purpose and legal basis of processing, the recipients, any cross-border transfer, the retention period, and their rights.
Where personal data was not collected from the person, give them the same information, plus its source and category, within a reasonable time and no later than when you first communicate with them or disclose the data to someone else.
Answer a person's request to know whether you process their data, and if so give them access to it along with the purpose, categories, recipients and retention period.
Correct a person's inaccurate personal data without undue delay on request, and let them complete incomplete data, including by providing a supplementary statement.
Erase a person's personal data without undue delay once it is no longer necessary for its purpose, consent is withdrawn with no other ground, the person objects with no overriding ground, it was processed unlawfully, or erasure is required by law.
Restrict processing on request while accuracy is disputed, the processing is unlawful but the person opposes erasure, you no longer need the data but the person needs it for a legal claim, or an objection is pending.
Tell every recipient the data was disclosed to about a correction, erasure or restriction, unless that is impossible or requires disproportionate effort.
Give a person their previously supplied personal data in a structured, commonly used, machine-readable format on request, and let them transmit it to another controller without hindrance.
Stop processing a person's data for direct marketing, including related profiling, the moment they object, and tell them about this right clearly and separately no later than your first contact with them.
Do not base a decision producing legal effects or significantly affecting a person solely on automated processing, including profiling, unless it is necessary for a contract with them, authorized by law with adequate safeguards, or based on their explicit consent, and even then give them the right to obtain human intervention, express their view, and contest the decision.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 23 requires a controller, when it collects personal data directly from a person, to give them its identity and contact details, the purpose and legal basis, the recipients, any cross-border transfer, the retention period, and their rights. Article 24 extends a fuller version of that notice to data obtained from elsewhere, due within a reasonable time and no later than the first communication with the person or the first disclosure of the data.

Article 26 gives a person the right to confirmation of whether their data are processed, access to the data, and information on the purpose, categories, recipients and retention period, while article 28 limits that access only to the extent and duration necessary and proportionate in a democratic society. Article 29 gives a right to rectification of inaccurate data and completion of incomplete data.

Article 30 gives a right to erasure on listed grounds including that the data are no longer necessary, consent has been withdrawn, the person has objected, or the processing was unlawful. Article 31 gives a right to restriction of processing while accuracy is disputed, an objection is pending, or the data are needed only for a legal claim.

Article 33 requires the controller to tell every recipient the data were disclosed to about a correction, erasure or restriction, unless that is impossible or disproportionately burdensome. Article 36 gives a right to receive previously supplied personal data in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance.

Article 37 gives an unconditional right to object to processing for direct marketing, including related profiling, requiring the controller to stop on the first objection and to flag this right clearly and separately no later than the first contact with the person.

Article 38 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them, unless the decision is necessary for a contract, authorized by law with adequate safeguards, or based on explicit consent, and even then guarantees the right to human intervention, to express a view, and to contest the decision.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Zakon o zastiti podataka o licnosti, full consolidated statute text (paragraf.rs)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app