Law note · Serbia
Law on Personal Data Protection
The Personal Data Protection Act has been applicable since 2019 and is closely General Data Protection Regulation (GDPR)-modelled per Chambers and Partners' 2026 practice guide, though the lawful-basis and controller and processor articles were not independently confirmed against primary text. Biometric data for unique identification is confirmed as an explicit special category, generally prohibited unless a specific exemption applies.
A real, moderate cross-border transfer regime is confirmed: transfers to adequate-level countries proceed freely, and other destinations need safeguards such as standard contractual clauses, binding corporate rules, or Commissioner-authorized clauses. Primary text confirms a standalone civil damages right under Article 86, separate from the administrative complaint and lawsuit procedures at Articles 82 to 84. Breach notification's existence was not confirmed either way.
What it asks of an app
- Establish a lawful basis and allocate controller and processor duties before processing personal data of a person in Serbia.
- Obtain a valid exemption, such as explicit consent, before processing biometric data of a person in Serbia for the purpose of unique identification.
- Rely on an adequacy-level destination or a safeguard such as standard contractual clauses, binding corporate rules, or a Commissioner-authorized clause before transferring personal data of a person in Serbia outside the country.
- Expect a person in Serbia to have a court-enforceable damages claim under Article 86 for material or non-material harm from an infringement of this law, separate from a complaint to the Commissioner.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Chambers and Partners 2026 Serbia Data Protection and Privacy practice guide
paragraf.rs consolidated statute text, read through crawler infrastructure (171,316 characters, not truncated) for Article 86