Serbia's draft Personal Data Protection Law: What changes are on the table

On 30 July, the Ministry of Justice of the Republic of Serbia published a draft Law on Personal Data Protection and opened it for public consultation through 10 Sept. 

Roughly seven years since the current Law on Personal Data Protection took effect, the draft grows from 102 to 175 articles, restructures the law and legislates in areas the 2018 version never contemplated. While the draft remains subject to change, there are some significant novelties to consider.

A restructured law, with separated law enforcement processing 

A frequent criticism of the current LPDP was that it folded data processing by law enforcement and national security entities — modeled on the EU Law Enforcement Directive — into the same provisions as ordinary data processing. 

The draft answers this by splitting the law into three parts and carving data processing by competent authorities for "special purposes" into a dedicated area, with the general regime applying secondarily.

Two entirely new fields: AI and video surveillance

The draft regulates personal data processing through artificial intelligence, distinguishing high-risk systems — which trigger a mandatory data protection impact assessment and an opinion from the Commissioner for Information of Public Importance and Personal Data Protection — from systems that interact directly with individuals and minimal-risk systems, and requiring the labeling of synthetically generated or modified audio and video content. 

It permits AI training on a legitimate-interest basis only "in exceptional cases" where that interest overrides data subject rights. 

Equally new is a detailed video surveillance regime spanning business premises, residential buildings and public areas, a general prohibition on monitoring employees' work absent narrow exceptions and a six-month retention cap for footage.

Legitimate interest gains a definition and special-category expansion