Law on Information Security

The Law on Information Security governs protection of information and communication systems, security-risk management and response to incidents. It covers operators’ responsibilities, systems of special significance, registration, protective measures, information exchange, CERT functions and supervision. Its purpose includes safeguarding availability, integrity and confidentiality, particularly where important services depend on these systems.

Every internet user and every operator does not have identical obligations. Establish the system’s legal category and the duties of the organisation managing it first. An operator should check risk management, security policies, internal responsibilities and the relevant arrangements for recording and reporting incidents. Specific deadlines and actions must be checked in the current law and applicable implementing regulations rather than assumed from general cybersecurity guidance.

For users, the law helps explain a service provider’s responsibilities and where a security problem can be reported. Keep the time of the event, description of its impact, messages and other available evidence, without accessing another person’s system unlawfully. Direct a report to the competent operator or relevant CERT according to the sector and system. A security incident is not automatically a personal-data breach or criminal offence; those questions may also require a separate approach to the Commissioner, police or another competent authority.

The current basic law appeared in Official Gazette RS 91/2025. It replaces the 2016 legislation subject to explicit transitional exceptions. Earlier implementing regulations continue pending new ones under the transitional rules. The earlier law should not be presented as the current principal legislation.

At the October 2026 verification, the new Office for Information Security has not begun the work scheduled for 1 January 2027. Until then RATEL performs National CERT functions, with a separate transitional role for the Office for IT and eGovernment. Article 29 also applies from 1 January 2027. Check transitional Articles 54–58 and the specific official Legal Information System text.

This is Avangarda’s editorial information overview, rather than the statutory text or advice for an individual case. This translation is editorial and is not an official translation of Serbian legislation. Check the current official text, special legislation and your documents for a specific situation, and obtain qualified legal assistance where needed.

Explains operators’ security duties, system categories, incident reporting and transitional responsibilities.

ICT-system operators, especially those covered as priority or important systems, and their users; obligations differ by legal category.

When assessing organisational security duties, preparing safeguards, handling an incident or checking which CERT is competent.