--- title: "Serbia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/serbia/ source_html: /jurisdictions/serbia/index.html description: "Serbia data protection and privacy regulation: 10 categories, 71 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: fcf9d5054740f2f559fd46d45bc7d84c151717f80325ec72b38d712a41d6c316 generator: "fe-fleet/md-twin@1.0" --- # Serbia Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Serbia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 71 claims · 36 sources in the cumulative register Download report (PDF) Expand all Serbia's Ministry of Justice published a draft Law on Personal Data Protection on 30 July 2026, opening public consultation until 10 September 2026. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Lawful Processing & Special Data, Sectoral Watch, AdTech & Commercial Privacy, Children & Vulnerable Groups (5 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SERBIA)[Build Report](/reports/?j=SERBIA)[Compare](/compare/?j=SERBIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Commissioner for Information of Public Importance and Personal Data Protection (Pover Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 3 Red categories 57 Sub-modules 71 Claims 8 Tier-1 sources Traffic-light mix 2 green 5 amber 3 red (sums to 10 rendered categories; click to filter) 3 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,073 Full executive summary 418 ###### Latest update · 4 November 2026 #### Lead Signal Serbia's data protection framework is approaching a legislative inflection point. The settled 2018 Law on Personal Data Protection, a 102-article instrument modelled on the GDPR, remains in force and unchanged in its operative provisions, but a substantial 175-article replacement was released on 30 July 2026 and its public consultation closed on 10 September 2026. The draft would add dedicated treatment of artificial intelligence, video surveillance and modular data-transfer tools, but its next legislative step, whether submission to the National Assembly or otherwise, is not confirmed. Serbia is, in effect, governed today by a regime it may be in the process of replacing wholesale, without a confirmed timeline for when that replacement might take effect. The practical significance of this is that two different penalty regimes now sit side by side in the public record: the current maximum fine for legal-entity controllers and processors, understood to be approximately EUR 17,000, remains materially below the GDPR's EUR 20 million or four-percent-of-turnover maxima, while the draft law would raise the floor and introduce proportionality mechanics without closing that gap to EU levels. #### Other Developments The draft replacement law would introduce a dedicated governance layer for high-risk artificial intelligence systems , requiring a mandatory data protection impact assessment and a prior opinion from the Commissioner for Information of Public Importance and Personal Data Protection before such systems could be deployed. This obligation does not yet exist under the current 2018 Law and is not in force; reports suggest it is contained in the draft text released for consultation, though its eventual enactment is not confirmed. The draft law would also recalibrate the enforcement regime by raising the statutory minimum fine from RSD 50,000 to RSD 200,000 and introducing a proportionality multiplier of up to twenty times the damage caused, capped overall at roughly five times the highest prescribed fine, equivalent to approximately EUR 85,000. The current fixed maximum fine of RSD 2,000,000 for legal entities would be retained under the draft rather than replaced with a turnover-based test, meaning that even under the proposed reform Serbia's ceiling would remain well below the GDPR's proportional-turnover model. #### Cross-Monitor Connections The draft law's proposed treatment of high-risk artificial intelligence systems, requiring impact assessment and prior regulatory opinion before deployment, connects directly to the governance questions tracked by the artificial-intelligence monitor, particularly around how national data protection authorities are being assigned AI-oversight functions ahead of, or in parallel with, dedicated AI-specific legislation. The draft's treatment of surveillance and modular transfer tools may also be of interest to that monitor's work on algorithmic governance architecture more broadly. No link to financial-integrity, world-payments, advennt or crypto monitoring was identified in the material. #### Outlook The central open question is procedural rather than substantive: whether the draft law advances to the National Assembly, and on what timetable, given that its consultation period closed in September 2026 without a confirmed next step as at this writing. Until that step is confirmed, the current 2018 Law remains the operative legal reality, including its comparatively low fixed penalty ceiling. If the draft does advance, the most consequential elements to watch are the AI-specific impact-assessment and prior-opinion requirement, which would hand the Commissioner a gatekeeping role over deployment of high-risk systems, and the enforcement recalibration, which raises exposure at the margin without adopting a turnover-based ceiling. Both would mark a structural tightening of the regime even though neither closes the gap to GDPR-equivalent penalty exposure. 4 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Serbia's Ministry of Justice published a draft Law on Personal Data Protection on 30 July 2026, opening public consultation until 10 September 2026. The draft would expand the current 102-article 2018 law into a 175-article statute organised into three distinct parts, and is understood to be the most significant structural data-protection reform proposal Serbia has produced since the original 2018 law. Its most consequential provisions concern artificial intelligence and surveillance governance: the draft would distinguish high-risk AI systems, subject to mandatory data protection impact assessment and a Commissioner opinion, from lower-risk systems, would require labelling of synthetically generated or modified audio and video content, and would introduce a general prohibition on workplace employee monitoring subject only to narrow exceptions. Notably, despite this expansion in scope, the draft declines to adopt GDPR-style turnover-based fines, retaining a fixed-fine model and raising only the minimum fine from RSD 50,000 to RSD 200,000 while leaving the RSD 2,000,000 maximum unchanged. #### Other Developments Cross-border transfer whitelist carries a stale reference. Serbia's current transfer regime, which requires the Commissioner's prior consent for transfers outside a whitelist of states set under Official Gazette RS 55/19, includes the United States only via the EU-US Privacy Shield framework, an arrangement the Court of Justice of the European Union invalidated. Whether this reference has been formally reconciled remains unconfirmed, and the draft law's reported introduction of more modular, GDPR-aligned transfer tools is the most likely vehicle for eventually resolving it. Enforcement practice shifting toward outcome-oriented review. The Commissioner's 2026 annual publication describes a shift during 2025 toward fact-specific, outcome-oriented case resolution, emphasising accountability and proportionality. This practice shift is occurring independently of, and ahead of, the legislative reform. Draft law would tighten the AI-training lawful basis. The draft is understood to restrict reliance on legitimate interest as a lawful basis for AI model training to exceptional cases where that interest is found to override data-subject rights, a narrower gateway than the general legitimate-interest test. #### Cross-Monitor Connections The draft law's AI-risk governance provisions, including the high-risk/DPIA-plus-opinion distinction and the AI-training lawful-basis restriction, are directly relevant to the Artificial Intelligence Monitor's coverage of Serbia and should be read alongside any AI-specific regulatory tracking there rather than duplicated here. The employee-monitoring prohibition and the broader draft-law reform carry no direct financial-integrity or payments dimension identified this cycle and are not routed elsewhere. #### Outlook The consultation period closing 10 September 2026 is the decisive near-term event: the draft's AI-governance, biometric, surveillance-restructuring, and cross-border-transfer provisions could all still be amended before any parliamentary reading, and every provision discussed above carries proposed-stage status only. The stale Privacy Shield reference in the current whitelist regime remains an open compliance question independent of the broader reform timeline, and is worth monitoring for a standalone correction even if the wider draft law's timeline slips. Read full brief · 1073 words ###### Latest update · 25 October 2026 #### Regulatory Status Serbia's data protection regime is currently governed by the 2018 Law on Personal Data Protection, overseen by the Commissioner for Information of Public Importance and Personal Data Protection, an autonomous authority combining data protection supervision with freedom-of-information oversight. The material development is the Ministry of Justice's publication, on 30 July 2026, of a draft replacement law, open for consultation through 10 September 2026, reported to expand the current 102-article text to 175 articles. The draft is reported to introduce a risk-tiered approach to artificial-intelligence processing, including mandatory impact assessments and prior Commissioner opinions for high-risk systems, and a dedicated video-surveillance chapter with a general employee-monitoring prohibition, a six-month footage-retention cap, and a one-year access-log retention period. The draft is reported to leave the existing enforcement ceiling unchanged despite this substantive expansion. Whether the draft has advanced beyond the consultation close toward government or parliamentary submission has not been confirmed. #### Outlook The key date to watch is confirmation of the draft's progress toward formal submission. If enacted broadly as reported, Serbia's framework would gain considerably more detailed rules for AI processing and video surveillance while retaining an enforcement ceiling that remains well below the General Data Protection Regulation standard. 1 earlier update not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Serbia's data protection landscape this cycle is dominated by the Ministry of Justice's 30 July 2026 publication of a draft Law on Personal Data Protection, in consultation until 10 September 2026, which would expand the current 102-article law into a 175-article statute across three parts. The draft's most consequential provisions span AI-risk governance (a high-risk/DPIA-plus-opinion tier and synthetic-media labelling), a general prohibition on workplace employee monitoring, and an AI-training-specific narrowing of the legitimate-interest lawful basis. The draft declines to adopt GDPR-style turnover-based fines, instead raising the minimum fixed fine from RSD 50,000 to RSD 200,000. Separately, Serbia's existing cross-border transfer whitelist retains an apparently stale reference to the invalidated EU-US Privacy Shield framework, and the Commissioner's 2026 annual publication shows enforcement practice shifting toward a more fact-specific, outcome-oriented approach. #### Outlook The consultation period closing 10 September 2026 is the decisive event to watch across every module above; all draft-law provisions remain proposed-stage until enactment. The stale Privacy Shield reference in the current whitelist is a separate, standing compliance question that could in principle be resolved independently of the wider reform timeline. Read full brief · 418 words Key regulatory facts for Serbia Regulatory Dimension Serbia Standing Position Jurisdiction Serbia (RS) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 71 sourced findings) Regulator & Framework Core statute and regulator are well-documented, in force, and actively enforced (including against multinational platforms); only the registration/filing sub-module lacks direct confirmatory evidence. Lawful Processing & Special Data Lawful bases and special-category rules are evidenced as GDPR-mirroring with one concrete regulator opinion (biometrics); consent-threshold detail and pseudonymisation/anonymisation provisions lack direct... Data Subject Rights Rights framework is confirmed as GDPR-mirroring at a general level via secondary commentary, but granular deadline/response-window detail and low utilization data indicate weak practical traction. Controller/Processor Duties DPIA tooling is concretely evidenced; DPO/security/breach provisions rest on general secondary-source mirroring language; ROPA, joint-controller and retention specifics are unconfirmed gaps. Primary Instruments Cited Poverenik.rs, Poverenik.rs, DataGuidance, Captain Compliance, IAPP Last Confirmed / Updated 2026-11-04 (36 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Serbia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core statute and regulator are well-documented, in force, and actively enforced (including against multinational platforms); only the registration/filing sub-module lacks direct confirmatory evidence. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Green Core statute and regulator are well-documented, in force, and actively enforced (including against multinational platforms); only the registration/filing sub-module lacks direct confirmatory evidence. #### Sub-modules (5) #### Regulator And AuthorityGreen The Commissioner combines DP and FOI mandates in one office, elected by the National Assembly. Claims (5): - The Commissioner for Information of Public Importance and Personal Data Protection is Serbia's primary data protection authority, combining data-protection and freedom-of-information supervisory mandates in one office. - Commissioner for Information of Public Importance and Personal Data Protection — Serbia's independent and autonomous data-protection supervisory authority, competent for oversight of the Law on Personal Data Protection. - Commissioner for Information of Public Importance and Personal Data Protection — Data-protection supervision with freedom-of-information oversight in a single autonomous office. - Commissioner for Information of Public Importance and Personal Data Protection — Autonomous public authority exercising DP supervisory powers independently under the PDPA, combined with freedom-of-information oversight. - Commissioner for Information of Public Importance and Personal Data Protection — The Commissioner is an autonomous public authority exercising its data-protection powers independently of any other body. #### Act And InstrumentsGreen LPDP (Official Gazette RS No. 87/2018) is the core GDPR-aligned omnibus instrument. Claims (7): - The Law on Personal Data Protection (Official Gazette of RS No. 87/2018) is Serbia's omnibus data-protection statute, adopted as part of Serbia's EU-candidacy harmonization with the GDPR. - Draft Law on Personal Data Protection (2026) — Released 30 July 2026, expanding the current 102-article 2018 framework to 175 articles, adding AI, video-surveillance and modular-transfer-tool provisions while retaining a fixed (non-turnover-based) maximum fine; consultation closed 10 September 2026. - Draft Law on Personal Data Protection (Serbia) — Published by the Ministry of Justice on 30 July 2026, expanding the statute from 102 to 175 articles; public consultation ran until 10 September 2026. - Draft Law on Personal Data Protection (Serbia) — No confirmation found that the Draft Law has advanced to Government adoption or parliamentary submission following the 10 September 2026 consultation close. - Ministry of Justice — Draft Law on Personal Data Protection on 30 July 2026, expanding the 102-article 2018 framework to 175 articles restructured into three parts, public consultation open until 10 September 2026. - Draft Law on Personal Data Protection (Ministry of Justice) — Published 30 July 2026, consultation through 10 September 2026, expanding the 102-article 2018 law to 175 articles, restructuring general and law-enforcement/national-security processing into distinct parts. - The Commissioner's Office is preparing its own model draft of a new Law on the Protection of Personal Data for submission to the Working Group, signalling a prospective ground-up replacement of the 2018 PDPA rather than incremental amendment; no draft text, instrument number or commencement date exists yet. #### Material ScopeAmber General LPDP material scope mirrors GDPR; not independently re-verified article-by-article in this run. #### Territorial ScopeGreen Extraterritorial application requiring local representative appointment (LPDP Art. 44), tested via 2020 Google/Facebook investigation. Claims (2): - The LPDP applies to foreign controllers/processors that are not established in Serbia, mandating appointment of a local representative under Article 44, similar to GDPR Article 27 requirements for non-EU controllers. - Draft Law on Personal Data Protection (Serbia), territorial scope clause — Links application to processing carried out 'within the framework of activities on the territory of the Republic of Serbia,' which commentators argue may fail to capture non-established controllers monitoring Serbian residents, unlike the 2018 law's GDPR-style targeting/monitoring test. #### Regulator Registration And FilingAmber No evidence found of a general notification/registration regime for controllers. Claims (1): - Serbia's LPDP does not appear to impose a general controller registration/filing requirement with the Commissioner, consistent with the GDPR's abolition of general notification obligations. Serbia's data-protection regime is anchored in the Law on Personal Data Protection ('Official Gazette of RS' No. 87/2018, 'LPDP'), adopted as part of Serbia's EU-candidacy harmonization obligations and structurally mirroring the GDPR. The LPDP is supervised by the Commissioner for Information of Public Importance and Personal Data Protection ('Poverenik'), a single body combining data-protection and freedom-of-information oversight functions, structurally analogous to Hungary's NAIH. The LPDP applies extraterritorially to foreign controllers/processors targeting or monitoring Serbian data subjects, who must appoint a local representative under LPDP Article 44 (mirroring GDPR Article 27); enforcement of this requirement has already been tested against major global platforms. No specific general controller registration/filing regime with the Commissioner was identified in available sources, consistent with the GDPR's own move away from notification-based regimes. Periodic update · new data 2026-11-04 #### Regulator & Framework Serbia's data protection architecture rests on a single autonomous authority, the Commissioner for Information of Public Importance and Personal Data Protection, which combines data protection supervision with freedom-of-information oversight in one office, a structural arrangement comparable to Hungary's NAIH model rather than the dedicated single-mandate authorities found in most EU member states. This office remains the settled institutional anchor regardless of the legislative changes now under consideration. The substantive framework it supervises is at a point of transition. The current Law on Personal Data Protection, a 102-article statute modelled closely on the GDPR, remains fully in force, but a draft replacement law released on 30 July 2026 would expand it to 175 articles. The draft adds dedicated provisions on artificial intelligence, video surveillance and modular data-transfer tools, areas the current law addresses only thinly if at all. Public consultation on the draft closed on 10 September 2026, and as at this writing its next procedural step, whether submission to the National Assembly or further revision, has not been confirmed. This leaves Serbia in a position where the operative law and the prospective law diverge meaningfully in scope, with no confirmed date by which that divergence will be resolved. One structural feature of the draft that stands out against its otherwise substantial expansion is what it does not change: the maximum fine for legal-entity controllers and processors would remain a fixed amount rather than being converted to a turnover-based test of the kind used under the GDPR. This means that even a successful enactment of the wider 175-article framework would not, on current reporting, bring Serbia's penalty ceiling into alignment with EU levels, even as its substantive scope of coverage broadens considerably. That combination, broader substantive reach paired with a retained low fixed ceiling, is itself a notable design choice rather than an oversight, and it shapes how much practical deterrent effect the reform would carry if enacted as drafted. The degree of confidence attached to these findings varies by element. The existence, scope and consultation timeline of the draft law are reported consistently and are treated as probable. The precise legislative mechanism by which the draft would proceed to enactment, and the timing of any such step, remain unconfirmed and are not asserted here beyond noting the gap. #### Outlook The determinative event to watch is whatever happens next in the legislative process: submission to the National Assembly, further revision following the September 2026 consultation close, or continued limbo. Until one of those occurs, the 102-article 2018 Law remains the only binding instrument, and the Commissioner's dual mandate over data protection and freedom-of-information matters continues unchanged as the implementing authority. Given the scale of the proposed expansion, nearly doubling the article count and introducing entirely new subject areas, any confirmed procedural movement would itself be a significant marker worth tracking closely, independent of whether the substantive provisions change further between now and enactment. 4 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Serbia's data protection framework is currently anchored by the Law on Personal Data Protection, in force since 2018, with the Commissioner for Information of Public Importance and Personal Data Protection acting as the autonomous supervisory authority. The Commissioner combines data protection supervisory powers with a separate freedom-of-information oversight role, a dual mandate that distinguishes the institution from a number of its regional counterparts that hold a narrower data protection remit alone. The principal development is the publication, on 30 July 2026, of a draft replacement Law on Personal Data Protection by the Ministry of Justice, opened for public consultation through 10 September 2026. The draft is reported to propose a substantial expansion from the current 102 articles to 175 articles, a near-seventy-percent increase in statutory length that signals a comprehensive rewrite rather than a targeted amendment. A key structural feature of the proposed rewrite is the separation of general data processing from processing carried out for law-enforcement and national-security purposes into distinct parts of the law, a structural choice that mirrors the European Union's own separation between the General Data Protection Regulation and the Law Enforcement Directive, suggesting the drafters are working toward closer structural parity with the EU framework rather than a standalone domestic model. What has not been confirmed is whether the draft has proceeded beyond the 10 September 2026 consultation close toward formal submission to the government or the National Assembly. The absence of a confirmed next-step date means the draft remains, for now, a consultation document rather than a bill with an identifiable legislative timeline. This matters for how the development should be weighted: a draft at the consultation stage carries real signal about regulatory direction and intent, but it is not yet binding, and its final form may differ from what was published for comment. The scale of the proposed expansion, from 102 to 175 articles, is itself a notable framework-level fact independent of what any individual new provision says. A law that nearly doubles in length is, by construction, addressing categories of processing or governance questions that the current text does not address in comparable detail, which is consistent with what the draft is reported to add in the areas of artificial-intelligence risk tiering and video surveillance, covered separately below. The framework-level takeaway is that Serbia is moving, at least at the drafting stage, toward a materially more granular and more EU-aligned statutory structure than the 2018 law currently provides. No change to the Commissioner's institutional status or founding mandate was identified; the autonomous, dual-mandate character of the authority persists both under the current law and, as far as has been reported, under the structure proposed by the draft. The continuity of institutional architecture alongside a substantial rewrite of substantive obligations suggests the reform is aimed at modernising the law's content rather than restructuring the regulator itself. #### Outlook The key date to track is whether and when the draft Law on Personal Data Protection advances from the closed consultation period toward government or parliamentary submission; no such confirmation exists as. Given the scale of the proposed rewrite — very nearly doubling the length of the current law and introducing a structural separation between general and law-enforcement/national-security processing — confirmation of a submission date would be the clearest signal of how seriously the reform is being pursued and on what timeline it might reach force. Until that confirmation exists, the 2018 law and the Commissioner's existing powers remain the governing framework in practice, with the draft representing a stated but not yet enacted direction of travel. Periodic update · new data 2026-10-18 #### Regulator & Framework The Commissioner for Information of Public Importance and Personal Data Protection is Serbia's independent and autonomous data-protection supervisory authority, competent for oversight of the Law on Personal Data Protection. This standing position combines the Commissioner's data-protection mandate with its longer-running freedom-of-information function. The Ministry of Justice published a draft Law on Personal Data Protection on 30 July 2026, intended to replace the Law on Personal Data Protection in force since 2018. Public consultation on the draft ran through 10 September 2026, and the draft is understood to expand the statute materially, from 102 to 175 articles. As at this writing, no confirmation has emerged that the draft has advanced to Government adoption or to submission before Parliament since the consultation closed; the next procedural step is open. A further point under discussion in commentary on the draft concerns its territorial scope clause, which links application of the law to processing carried out "within the framework of activities on the territory of the Republic of Serbia." Commentators have suggested this formulation may not adequately capture non-established controllers monitoring Serbian residents, a reach the 2018 law's GDPR-style targeting and monitoring test is understood to provide. The final enacted text on this point is not yet available, so how the provision will ultimately read -- and whether it will be narrowed or clarified before adoption -- remains unresolved. #### Outlook The draft Law's progression beyond consultation is the development to watch: whether it proceeds to Government adoption or parliamentary submission, and whether the territorial-scope formulation is revised in the process, will determine both the timeline to a new in-force statute and the eventual reach of Serbia's data-protection regime relative to the 2018 law's GDPR-aligned test. Periodic update · new data 2026-10-04 #### Regulator & Framework The Commissioner for Information of Public Importance and Personal Data Protection remains Serbia's autonomous data-protection authority, exercising its powers independently of any other body, a standing institutional fact unchanged this cycle. The material development is the Commissioner's own confirmation, made in the course of its Personal Data Protection Day 2026 remarks, that the Commissioner's Office is preparing its own model draft of a new Law on the Protection of Personal Data for submission to the inter-ministerial Working Group responsible for data-protection legislative reform. This is understood to be a prospective ground-up replacement of the current 2018 Law on Personal Data Protection, rather than an incremental amendment of specific provisions, though the scope of change, draft text, instrument number and any commencement date are not yet public. The significance of this development lies less in any confirmed substantive change, since none has yet been drafted or tabled, and more in the signal of intent: the Commissioner itself, rather than the Ministry or another drafting body, is positioning to author the baseline text that will be put before the Working Group. This gives the independent regulator a direct hand in shaping the eventual legislative starting point, which is a materially different posture from a scenario in which an external ministry drafts the instrument and the Commissioner is consulted only after the fact. Whether the Working Group ultimately adopts the Commissioner's own model, amends it substantially, or proceeds with an alternative draft remains to be seen, and no timeline for Working Group submission or subsequent parliamentary process has been confirmed. In the meantime, the 2018 Law on Personal Data Protection remains the fully operative legal framework, and the Commissioner continues to exercise the full range of its existing powers under that Law, including its standing authority under Article 79 to order rectification of identified processing irregularities within a specified period or to impose a temporary processing ban where processing is carried out contrary to the Law. The Commissioner's Supervision Sector also reported having carried out more than 1,280 supervision inspections in the prior reporting year, indicating that current regulatory capacity remains active and substantial notwithstanding the prospective legislative rewrite. This supervisory activity level provides useful context for assessing how seriously to weight the ground-up-rewrite signal: it emerges from an active, operationally engaged regulator rather than one signalling reform from a position of institutional quiescence. #### Outlook The scope and timeline of the Commissioner's proposed new Law remain undetermined at this stage, and the gap in available information, specifically the absence of any public indication of when the model draft will be submitted to the Working Group, is itself a notable evidentiary limitation for assessing how near-term this development is likely to become material. Until a draft is formally tabled, the 2018 Law on Personal Data Protection remains the operative framework and the Commissioner's existing enforcement powers and institutional independence continue entirely unaffected. This is a development to track as scheduled, with the next meaningful milestone being either a public Working Group submission or further Commissioner commentary on the model draft's content and timing. Periodic update · new data 2026-09-28 #### Regulator & Framework Serbia's data protection regime is overseen by the Commissioner for Information of Public Importance and Personal Data Protection, an independent body that combines data protection supervision with a freedom-of-information mandate in a single institution. This dual-mandate structure is a standing feature of Serbia's regulatory architecture and distinguishes the Commissioner from single-purpose data protection authorities found in many other jurisdictions. The most significant development this cycle is the Commissioner's confirmation that work on a new Law on Personal Data Protection has progressed significantly. The stated aim of the anticipated law is to bring clearer, more GDPR-aligned rules, with particular attention to artificial intelligence and advanced digital systems. The Commissioner has publicly indicated that the reform is intended to better address AI and advanced digital systems, though it should be understood that no enacted AI-specific data protection provision currently exists in Serbia — the current framework remains the 2018 Law on Personal Data Protection, and the reform is a drafting-stage signal rather than a change in force. The specific contents of the draft, including its treatment of AI systems, have not been made public, and this brief does not speculate on provisions not yet disclosed. This is a forward-looking, preparatory development: it signals regulatory direction rather than an immediate change to controller or processor obligations. Organisations operating in Serbia should treat the current 2018 framework as the operative law while the reform remains undisclosed and unenacted. #### Outlook The key event to watch is publication of the draft new Law on Personal Data Protection. Until its text becomes available, the scope of any AI-specific provisions, and the extent of GDPR alignment being pursued, cannot be assessed. This module will be revisited once draft or enacted text is located. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (15) - [Poverenik.rs](https://www.poverenik.rs/en/o-nama/authority.html) — The Commissioner for Information of Public Importance and Personal Data Protection is Serbia's primary data protection authority, combining data-protection and freedom-of-information supervisory mandates in one office. - [Poverenik.rs](https://www.poverenik.rs/en/%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD%D0%B84/2970-%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD-%D0%BE-%D0%B7%D0%B0%D1%88%D1%82%D0%B8%D1%82%D0%B8-%D0%BF%D0%BE%D0%B4%D0%B0%D1%82%D0%B0%D0%BA%D0%B0-%D0%BE-%D0%BB%D0%B8%D1%87%D0%BD%D0%BE%D1%81%D1%82%D0%B8-%D1%81%D0%BB-%D0%B3%D0%BB%D0%B0%D1%81%D0%BD%D0%B8%D0%BA-%D1%80%D1%81-%D0%B1%D1%80-87-2018-%D0%BE%D0%B4-13-11-2018.html) — The Law on Personal Data Protection (Official Gazette of RS No. 87/2018) is Serbia's omnibus data-protection statute, adopted as part of Serbia's EU-candidacy harmonization with the GDPR. - [DataGuidance](https://www.dataguidance.com/news/serbia-poverenik-initiates-investigation-google-and) — The LPDP applies to foreign controllers/processors that are not established in Serbia, mandating appointment of a local representative under Article 44, similar to GDPR Article 27 requirements for non-EU controllers. - [Poverenik.rs](https://www.poverenik.rs/en/o-nama/authority.html) — Serbia's LPDP does not appear to impose a general controller registration/filing requirement with the Commissioner, consistent with the GDPR's abolition of general notification obligations. - [Captain Compliance](https://captaincompliance.com/news/serbias-draft-personal-data-protection-law-major-expansion-on-ai-surveillance-and-transfers/) — Draft Law on Personal Data Protection (2026) — Released 30 July 2026, expanding the current 102-article 2018 framework to 175 articles, adding AI, video-surveillance and modular-transfer-tool provisions while retaining a fixed (non-turnover-based) maximum fine; consultation closed 10 September 2026. - [IAPP](https://iapp.org/news/a/serbia-s-draft-personal-data-protection-law-what-changes-are-on-the-table) — Draft Law on Personal Data Protection (Serbia) — Published by the Ministry of Justice on 30 July 2026, expanding the statute from 102 to 175 articles; public consultation ran until 10 September 2026. - [Commissioner (RS)](https://www.poverenik.rs/en/) — Commissioner for Information of Public Importance and Personal Data Protection — Serbia's independent and autonomous data-protection supervisory authority, competent for oversight of the Law on Personal Data Protection. - [PR Legal](https://www.prlegal.rs/rethinking-serbias-data-protection-framework-key-issues-in-the-new-draft-law/) — Draft Law on Personal Data Protection (Serbia) — No confirmation found that the Draft Law has advanced to Government adoption or parliamentary submission following the 10 September 2026 consultation close. - [zzpl.rs](https://zzpl.rs/en/draft-law-on-personal-data-protection/) — Draft Law on Personal Data Protection (Serbia), territorial scope clause — Links application to processing carried out 'within the framework of activities on the territory of the Republic of Serbia,' which commentators argue may fail to capture non-established controllers monitoring Serbian residents, unlike the 2018 law's GDPR-style targeting/monitoring test. - Primary statutory record — Ministry of Justice — Draft Law on Personal Data Protection on 30 July 2026, expanding the 102-article 2018 framework to 175 articles restructured into three parts, public consultation open until 10 September 2026. - [DataProtection.gi](https://dataprotection.gi/jurisdictions/serbia/) — Commissioner for Information of Public Importance and Personal Data Protection — Data-protection supervision with freedom-of-information oversight in a single autonomous office. - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=RS) — Commissioner for Information of Public Importance and Personal Data Protection — Autonomous public authority exercising DP supervisory powers independently under the PDPA, combined with freedom-of-information oversight. - [IAPP](https://iapp.org/news/a/serbia-s-draft-personal-data-protection-law-what-changes-are-on-the-table) — Draft Law on Personal Data Protection (Ministry of Justice) — Published 30 July 2026, consultation through 10 September 2026, expanding the 102-article 2018 law to 175 articles, restructuring general and law-enforcement/national-security processing into distinct parts. - [DataProtection.gi](https://dataprotection.gi/jurisdictions/serbia/) — The Commissioner's Office is preparing its own model draft of a new Law on the Protection of Personal Data for submission to the Working Group, signalling a prospective ground-up replacement of the 2018 PDPA rather than incremental amendment; no draft text, instrument number or commencement date exists yet. - [DataProtection.gi](https://dataprotection.gi/jurisdictions/serbia/) — Commissioner for Information of Public Importance and Personal Data Protection — The Commissioner is an autonomous public authority exercising its data-protection powers independently of any other body. ### Serbia: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Lawful bases and special-category rules are evidenced as GDPR-mirroring with one concrete regulator opinion (biometrics); consent-threshold detail and pseudonymisation/anonymisation provisions lack direct primary-source confirmation in this run. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Amber Lawful bases and special-category rules are evidenced as GDPR-mirroring with one concrete regulator opinion (biometrics); consent-threshold detail and pseudonymisation/anonymisation provisions lack direct primary-source confirmation in this run. D2 · Lawful Processing — Full Module Record 4 sub-modules · 69 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Serbia: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Rights framework is confirmed as GDPR-mirroring at a general level via secondary commentary, but granular deadline/response-window detail and low utilization data indicate weak practical traction. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Amber Rights framework is confirmed as GDPR-mirroring at a general level via secondary commentary, but granular deadline/response-window detail and low utilization data indicate weak practical traction. #### Sub-modules (5) #### Access RightAmber Access right mirrors GDPR Art. 15 per secondary commentary. Claims (1): - LPDP data-subject-rights provisions mirror GDPR normative provisions on data subject rights, though implementation and enforcement of these rights remains limited, with only 139 complaints lodged with the DPA in 2020. #### Rectification And ErasureAmber Rectification/erasure rights mirror GDPR structure. Claims (1): - LPDP data-subject-rights provisions mirror GDPR normative provisions on data subject rights, though implementation and enforcement of these rights remains limited, with only 139 complaints lodged with the DPA in 2020. #### Restriction And ObjectionAmber Restriction/objection rights mirror GDPR structure. Claims (1): - LPDP data-subject-rights provisions mirror GDPR normative provisions on data subject rights, though implementation and enforcement of these rights remains limited, with only 139 complaints lodged with the DPA in 2020. #### Data PortabilityRed Portability right presumed present via GDPR mirroring; not independently verified. #### Deadlines And Response WindowsRed No specific statutory deadline figures (e.g., 30-day response window) were confirmed for Serbia in this run. Claims (1): - Law on Personal Data Protection (Serbia, in force) — If a controller fails to act on a data subject's request, it must inform the individual of the reasons without delay and at latest within 30 days, together with the right to complain to the Commissioner or sue in court. The LPDP's data-subject-rights provisions (access, rectification, erasure, restriction, objection, portability) are described by secondary legal commentary as mirroring GDPR normative provisions, but practical exercise of these rights has historically been limited — Serbia's DPA reported only 139 complaints lodged in 2020. No Serbia-specific statutory response-deadline figures were independently confirmed in this run. Sources and claims (2) - [IAPP](https://iapp.org/news/a/serbian-law-on-personal-data-protection-law-after-two-years-of-implementation-and-harmonization-with-gdpr) — LPDP data-subject-rights provisions mirror GDPR normative provisions on data subject rights, though implementation and enforcement of these rights remains limited, with only 139 complaints lodged with the DPA in 2020. - [Paragraf Lex / Official Gazette text](https://www.paragraf.rs/propisi/zakon_o_zastiti_podataka_o_licnosti.html) — Law on Personal Data Protection (Serbia, in force) — If a controller fails to act on a data subject's request, it must inform the individual of the reasons without delay and at latest within 30 days, together with the right to complain to the Commissioner or sue in court. ### Serbia: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ DPIA tooling is concretely evidenced; DPO/security/breach provisions rest on general secondary-source mirroring language; ROPA, joint-controller and retention specifics are unconfirmed gaps. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Amber DPIA tooling is concretely evidenced; DPO/security/breach provisions rest on general secondary-source mirroring language; ROPA, joint-controller and retention specifics are unconfirmed gaps. D4 · Controller & Processor — Full Module Record 7 sub-modules · 80 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Serbia: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer-mechanism mirroring is evidenced at a general level; adequacy status (received) is a confirmed gap; SCC evidence is narrow/EU-instrument-specific; localisation and TIA sub-modules are unconfirmed. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Amber Transfer-mechanism mirroring is evidenced at a general level; adequacy status (received) is a confirmed gap; SCC evidence is narrow/EU-instrument-specific; localisation and TIA sub-modules are unconfirmed. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 117 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Serbia: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only the employment-data sub-module has a concrete regulator opinion; the remaining six sub-modules carry no confirmed sector-specific findings, consistent with commentary describing broad sectoral non-harmonization. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Red Only the employment-data sub-module has a concrete regulator opinion; the remaining six sub-modules carry no confirmed sector-specific findings, consistent with commentary describing broad sectoral non-harmonization. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 84 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Serbia: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a historical regulator statement about a persistent direct-marketing regulatory gap was located; the remaining five sub-modules carry no confirmed findings. Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Red Only a historical regulator statement about a persistent direct-marketing regulatory gap was located; the remaining five sub-modules carry no confirmed findings. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 64 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Serbia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric regime has a concrete regulator opinion; AI/genetic/video-surveillance regulation is confirmed as pending (proposed, not yet in force); profiling/ADM transparency and state-surveillance carve-outs are unconfirmed gaps. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018); draft LPDP amendments (biometric/genetic/AI/video surveillance) in preparation since 2025 Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Amber Biometric regime has a concrete regulator opinion; AI/genetic/video-surveillance regulation is confirmed as pending (proposed, not yet in force); profiling/ADM transparency and state-surveillance carve-outs are unconfirmed gaps. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance Serbia currently has no dedicated statutory framework governing algorithmic or high-risk artificial intelligence systems within its data protection law. That gap is precisely what the draft 175-article replacement Law on Personal Data Protection, released on 30 July 2026, is reported to address. Among its additions, the draft would introduce a mandatory data protection impact assessment requirement for high-risk AI systems, paired with a prior-opinion mechanism requiring sign-off from the Commissioner for Information of Public Importance and Personal Data Protection before such systems could be deployed. Neither requirement exists under the current 2018 Law, and neither is yet in force; the draft remains in post-consultation status with its next legislative step unconfirmed. The significance of this provision lies less in its detail than in its structural placement. Rather than creating a free-standing AI law, Serbia's draft approach would route AI governance through the existing data protection authority and the existing DPIA mechanism already used for other high-risk processing activities. This would hand the Commissioner a gatekeeping function specifically over deployment of high-risk AI systems, prior to launch, rather than a purely reactive enforcement role after harm has occurred. If enacted as reported, this would represent a meaningful expansion of the Commissioner's practical authority, extending its remit from traditional data protection supervision into pre-deployment technology review.

Because this entire development rests on a draft that has not been enacted, and because the precise operative detail, such as how high-risk status would be determined, what categories of system would be captured, and what form the prior opinion would take procedurally, has not been independently confirmed, this finding is reported with appropriate hedging. Reports suggest the mechanism exists in the draft text; confirmation of its final form, or any form at all, depends on what happens to the broader legislative package. #### Outlook The principal uncertainty is whether the draft law advances at all, and if so, whether the AI-governance provisions survive the legislative process intact or are narrowed. Because this provision is embedded within the larger 175-article package rather than standing as separate legislation, its fate is tied to the overall bill's progress, meaning that confirmation of the National Assembly timetable would be the clearest forward indicator to watch. Any confirmation that the DPIA and prior-opinion requirement has been carried into an enacted text, with defined scope for what counts as a high-risk AI system, would mark a substantive first for Serbia's data protection regime and would be the natural point at which a more assertive characterisation of this development becomes appropriate. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The draft Law on Personal Data Protection published for consultation on 30 July 2026 is reported to introduce the most detailed treatment of artificial-intelligence processing that Serbia's data protection framework has had to date. The draft is understood to distinguish three categories of system: high-risk systems, which would trigger a mandatory data protection impact assessment together with a prior opinion from the Commissioner before deployment; systems that interact directly with individuals; and minimal-risk systems, which presumably carry a lighter compliance burden. This tiered structure echoes the risk-based approach familiar from EU-level AI governance discussion, applied here specifically within a data protection instrument rather than a standalone AI law. A further reported feature of the draft is a restriction on the legal basis available for training artificial-intelligence systems: the draft would permit training on a legitimate-interest basis only in exceptional cases, which would narrow the default pathway many AI developers currently rely on for training-data processing in less prescriptive regimes. If adopted as reported, this would place a meaningfully higher compliance burden on AI training activity touching Serbian personal data than currently exists, requiring either a different lawful basis or qualification for the exceptional-case carve-out before legitimate interest could be relied upon. The draft is also reported to add a dedicated chapter addressing video surveillance, a form of processing that the current 2018 law does not appear to regulate with comparable specificity. The reported chapter covers surveillance of business premises, residential buildings, and public areas, and is understood to impose a general prohibition on monitoring employees in the workplace, subject only to narrow exceptions. Retention limits are a central feature of the reported chapter: footage itself would be capped at six months' retention, while records of access to that footage would be retained for one year. The combination of a general employee-monitoring prohibition with specific, relatively short retention ceilings suggests the drafters are treating video surveillance as a processing category warranting its own tailored proportionality rules, rather than leaving it to be governed by the law's general processing principles alone. Taken together, the AI risk-tiering provisions and the video-surveillance chapter represent the two most substantial reported additions to Serbia's data protection framework under the draft law, and both sit within governance of automated and surveillance-adjacent processing specifically, rather than in the law's general provisions. This is consistent with a broader regional and EU-adjacent trend of treating algorithmic and surveillance processing as categories requiring dedicated statutory attention beyond general data protection principles, rather than folding them into existing lawful-basis and data-subject-rights provisions without modification. It bears repeating that none of this is yet in force. The draft remains at the post-consultation stage, with consultation having closed on 10 September 2026 and no confirmation of further legislative progress. The reported provisions on AI risk tiers and video surveillance should therefore be read as the government's stated direction for reform, subject to revision before, if, and when the draft is formally submitted and adopted. #### Outlook The central question for this governance area is whether the AI risk-tiering and video-surveillance provisions survive from draft to enacted text in their currently reported form, and on what timeline. Given that these are the draft's most novel substantive additions relative to the 2018 law, they are also the provisions most likely to attract stakeholder comment during any further legislative process, which could affect their final shape. Confirmation of government or parliamentary submission, when it comes, will be the next concrete signal of how these provisions are likely to evolve before taking effect. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The draft Law on Personal Data Protection, published for consultation on 30 July 2026, is understood to introduce a tiered classification of AI-driven personal-data processing that has no equivalent in the 2018 Act. High-risk systems would trigger a mandatory data protection impact assessment and require a prior opinion from the Commissioner for Information of Public Importance and Personal Data Protection; a second tier covers systems that interact directly with individuals; a third covers minimal-risk systems. The draft is also reported to require labelling of synthetically generated or materially modified audio and video content, and to confine processing of personal data for AI training on a legitimate-interest legal basis to exceptional cases only. None of this is yet in force, and the final enacted text and its effective date are pending. The draft is further reported to add a dedicated chapter on video surveillance, an area commentary describes as likely to require organisations' first immediate review of existing practice once the law takes effect. The chapter would cap footage retention at a maximum of six months, generally prohibit monitoring of employees' work performance subject to narrow exceptions, and ban remote, mass and indiscriminate biometric identification carried out through video-surveillance systems. These provisions are absent from the Law on Personal Data Protection currently in force. Separately, the draft's definition of profiling is understood to drop the word "automated" that appears in the current formulation, redefining profiling instead as any form of processing used to assess certain characteristics of a natural person. This is a broader definition than the one in the 2018 law, potentially bringing manual or hybrid evaluative processing within the profiling concept where it previously fell outside it. #### Outlook Each of these three strands -- AI risk-tiering, video-surveillance governance and the broadened profiling definition -- depends on the draft Law's progression past consultation. Organisations operating video-surveillance systems or AI-driven evaluative processing in Serbia face a materially different compliance architecture if the draft is enacted substantially as published, but confirmation of enactment, timing and final wording is still pending. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 71 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Serbia: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a general statutory-mandate reference to minors was confirmed; all five declared sub-modules otherwise lack primary-source-verified detail. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Red Only a general statutory-mandate reference to minors was confirmed; all five declared sub-modules otherwise lack primary-source-verified detail. D9 · Children's Privacy — Full Module Record 5 sub-modules · 61 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Serbia: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Enforcement powers, penalty structure, and recent enforcement/case-volume activity are well-evidenced with multiple independent confirmations; only collective-redress/private-right-of-action detail is an unconfirmed gap. Primary framework Law on Personal Data Protection (Official Gazette of RS No. 87/2018) Supervisory authority [Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)](https://www.poverenik.rs/en/) Traffic-light rationale — Green Enforcement powers, penalty structure, and recent enforcement/case-volume activity are well-evidenced with multiple independent confirmations; only collective-redress/private-right-of-action detail is an unconfirmed gap. Periodic update · new data 2026-11-04 #### Enforcement & Redress Servia's current enforcement ceiling for data protection breaches is settled and well below the levels associated with the GDPR. Under the 2018 Law on Personal Data Protection, the maximum fine for legal-entity controllers and processors is approximately EUR 17,000, equivalent to RSD 2,000,000, a figure that has held since the law took effect and stands in stark contrast to the GDPR's maxima of EUR 20 million or four percent of global annual turnover. This gap has been a defining feature of the Serbian regime's practical deterrent profile since implementation. The draft 175-article replacement law, released on 30 July 2026 and now past its 10 September 2026 consultation close, would adjust this picture, but only partially. Reports suggest the draft raises the statutory minimum fine from RSD 50,000 to RSD 200,000, a fourfold increase at the floor, and introduces a proportionality multiplier of up to twenty times the damage caused by a given violation. That multiplier, however, is capped overall at approximately five times the highest prescribed fine, which commentary places at roughly EUR 85,000. Critically, the fixed maximum fine of RSD 2,000,000 for legal entities is reported to be retained rather than replaced with a turnover-based test of the kind the GDPR uses. This means that even under the proposed reform, enforcement exposure in Serbia would remain capped at a fixed ceiling rather than scaling with the size or revenue of the entity involved, a structural choice that preserves a material gap with EU-level enforcement exposure even as the floor and proportionality mechanics tighten. This combination, a materially higher minimum alongside a still-modest, fixed maximum, suggests a deliberate design intent to raise the penalty for minor and moderate violations without exposing large multinational controllers to GDPR-scale liability. Whether that reading holds will depend on how the provision is ultimately enacted, since the draft has not passed into law and its final form is not confirmed. The underlying penalty figures for the current law are reported with high confidence; the draft's proposed figures are reported as probable, reflecting reliance on secondary commentary describing a text that has not itself been independently verified against the Official Gazette. #### Outlook The enforcement trajectory to watch is whether the proportionality multiplier and raised minimum survive into an enacted text, and whether any future amendment moves further toward a turnover-based maximum given the gap that even the current draft would leave against GDPR levels. Absent such a shift, Serbia's penalty architecture will continue to diverge structurally from the EU model even as the rest of its substantive data protection provisions are reported to expand toward GDPR-equivalent coverage in other areas such as AI and surveillance governance. That asymmetry, broader substantive obligations paired with comparatively modest fixed-ceiling enforcement exposure, is itself the structural fact most worth monitoring going into any confirmed legislative next step. Periodic update · new data 2026-09-28 #### Enforcement & Redress The Commissioner for Information of Public Importance and Personal Data Protection holds the power to enforce its orders by threatening a company with a fine of up to ten percent of its annual income in Serbia for non-compliance. This is understood to be a significant enforcement lever on paper, though it is reported that this particular option has not yet been exercised in practice, leaving its real-world deterrent effect untested. Separately, the current Law on Personal Data Protection sets out a distinct sanctions structure: fines of up to approximately EUR 17,000 for a legal entity and approximately EUR 1,275 for a responsible person within a legal entity, with the Commissioner also able to directly fine controllers or processors approximately EUR 850 in certain situations. These figures sit well below the scale implied by the ten-percent-of-income enforcement threat, and the coexistence of a large discretionary enforcement power alongside comparatively modest fixed statutory fines is a structural feature of the current regime. The Commissioner's most recent annual publication, covering cases resolved in 2025, is understood to show a shift in enforcement approach: rather than framing decisions around abstract compliance discussion, the Commissioner is moving toward a fact-specific approach that weighs accountability, proportionality and necessity in individual cases. This suggests a maturing enforcement practice, though it is a qualified rather than confirmed characterisation, and it is not yet clear whether it corresponds to a rise in the number or severity of enforcement actions. #### Outlook Whether the Commissioner's fact-specific enforcement approach translates into a higher volume of published decisions, and whether the ten-percent-of-income fine-threat power is ever actually exercised, are the two enforcement-trajectory questions to watch. Both would be significant markers of a genuinely tightening enforcement posture in Serbia, distinct from the separate legislative-reform signal tracked under Regulator & Framework. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 135 words · 18 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties