Law / Serbia

Law on Personal Data Protection, transfer of personal data to other states

Law on Personal Data Protection arts. 63-72 (transfer of personal data to other states and international organizations), Official Gazette RS No. 87/2018

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 21 August 2019.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Transfer personal data outside Serbia freely only to a country, part of a country, sector, or international organization the Commissioner has found to ensure an adequate level of protection, a status presumed for parties to the Council of Europe's Convention 108 on automatic processing of personal data.
Absent an adequacy finding, transfer only where you have put in place appropriate safeguards, such as standard contractual clauses issued by the Commissioner, a legally binding instrument between authorities, or Commissioner-approved binding corporate rules, and only where the person retains enforceable rights and effective legal remedies.
Get the Commissioner's approval for binding corporate rules before relying on them, showing they legally bind every group member and its employees and expressly grant the person enforceable rights.
Do not recognize or comply with a foreign court's or authority's order to transfer or disclose personal data unless it rests on an international agreement, such as a mutual legal assistance treaty between Serbia and that country.
Absent an adequacy finding or safeguards, transfer personal data only under a listed derogation, such as the person's explicit and informed consent to the transfer, or necessity for a contract or an important public interest.

What it reaches

Obligation class

Transfer, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 64 permits a transfer to another country, part of its territory, a sector of activity there, or an international organization without prior approval where an adequate level of protection has been found, a status presumed for parties to the Council of Europe's Convention on the protection of individuals with regard to automatic processing of personal data.

Article 65 lets a controller or processor transfer personal data absent an adequacy finding only where it has put in place appropriate safeguards, such as a legally binding instrument between authorities, standard contractual clauses issued by the Commissioner, or binding corporate rules, and only where the person retains enforceable rights and effective legal remedies.

Article 67 requires the Commissioner to approve binding corporate rules before they may be relied on, checking that they bind every group member and its employees and expressly grant the person enforceable rights. Article 68 bars recognizing or enforcing a foreign court's or administrative authority's order to transfer or disclose personal data in Serbia unless it rests on an international agreement, such as a mutual legal assistance treaty between Serbia and that state.

Absent an adequacy finding or safeguards, article 69 allows a transfer only under a listed derogation, including the person's explicit consent given after being informed of the risks, necessity for a contract with or in the interest of the person, or an important public interest defined by Serbian law.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics

Read the law

Zakon o zastiti podataka o licnosti, full consolidated statute text (paragraf.rs)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app