Law on Personal Data Protection
The law regulates lawful processing of information about individuals and the duties of those collecting, using or storing it. It provides information and access rights, other forms of control, complaints to the Commissioner and judicial protection.
Avangarda does not provide legal representation. These materials are here to inform and to make rights easier to understand. For a concrete legal procedure, contact a lawyer, legal aid service or the relevant institution.
Privacy and data protection
Serbia’s Law on Personal Data Protection, Official Gazette RS 87/2018, protects individuals when their personal data are processed. It has applied since 22 August 2019. It establishes a general processing regime and special rules for competent authorities processing data for criminal justice purposes. A published draft or consultation does not replace the enacted law.
Personal data may include a name, identification number, image or other information relating to an identifiable person. The controller determines why and how data are processed; a processor acts on the controller’s behalf. Processing needs an appropriate legal basis, a defined purpose and data limited to what is necessary. Consent is one legal basis, rather than a requirement for every lawful activity. The law also recognises bases involving contracts, statutory duties and specified public or other legitimate interests. Particularly sensitive data require additional safeguards.
Individuals can request information about processing and access to their data, and seek correction of inaccuracies. Erasure, restriction, objection and portability have specific conditions. They do not create an unlimited right to remove every record. Legal retention duties, other people’s rights and statutory exceptions may affect the answer. Send the request to the controller, identify the right being exercised and keep proof of submission. Identity checks should relate to the particular request.
The controller must inform the person of action taken without undue delay and no later than 30 days after receipt. This period can be extended by another 60 days because of complexity or the number of requests. The controller must notify the person of the extension and reasons within the initial 30 days. A refusal must explain the reasons and available protection.
The Commissioner for Information of Public Importance and Personal Data Protection supervises compliance. An individual may complain to the Commissioner. Court protection against a controller or processor and an administrative dispute challenging the Commissioner’s decision are distinct procedures. Where harm has occurred, the appropriate claim and responsibility depend on the law and evidence. Keep the request, response, privacy notice and a description of the disputed processing. The official source below links to the enacted law.
This is Avangarda’s editorial overview, not the wording of the law. Translations of this overview are not official translations of the legislation. Check the current legal text and seek professional legal help where needed.
What is this for?
It helps you identify who processes your data, the legal basis and purpose, and choose an appropriate request or route to protection.
Who can use it?
Individuals whose data are processed, their representatives, controllers, processors, employers, public authorities and organisations. Duties and rights depend on the role and processing involved.
When should it be used?
When seeking a copy of your data, correction of errors, an explanation of processing, or protection against unauthorised use, disclosure or retention.