On 30 July, the Ministry of Justice of the Republic of Serbia published a draft Law on Personal Data Protection and opened it for public consultation through 10 Sept.

Roughly seven years since the current Law on Personal Data Protection took effect, the draft grows from 102 to 175 articles, restructures the law and legislates in areas the 2018 version never contemplated. While the draft remains subject to change, there are some significant novelties to consider.

A restructured law, with separated law enforcement processing

A frequent criticism of the current LPDP was that it folded data processing by law enforcement and national security entities — modeled on the EU Law Enforcement Directive — into the same provisions as ordinary data processing.

The draft answers this by splitting the law into three parts and carving data processing by competent authorities for "special purposes" into a dedicated area, with the general regime applying secondarily.

Two entirely new fields: AI and video surveillance

The draft regulates personal data processing through artificial intelligence, distinguishing high-risk systems — which trigger a mandatory data protection impact assessment and an opinion from the Commissioner for Information of Public Importance and Personal Data Protection — from systems that interact directly with individuals and minimal-risk systems, and requiring the labeling of synthetically generated or modified audio and video content.

It permits AI training on a legitimate-interest basis only "in exceptional cases" where that interest overrides data subject rights.

Equally new is a detailed video surveillance regime spanning business premises, residential buildings and public areas, a general prohibition on monitoring employees' work absent narrow exceptions and a six-month retention cap for footage.

Legitimate interest gains a definition and special-category expansion

Legitimate interest already exists as a legal basis under the current LPDP, but the draft adds a statutory definition of the concept, framed around necessity, suitability, proportionality and the data subject's "reasonable expectations."

The draft also reorders the legal bases. Where the current law lists consent first, the draft places compliance with legal obligations and public-interest tasks ahead of consent and gives each basis its own article.

Special-category rules tighten, too, as "membership in a political entity" is expressly added, and biometric processing on consent requires offering a less-intrusive alternative.

Standard contractual clauses go modular

The most consequential data transfer change concerns standard contractual clauses. Under current law, SCCs govern only transfers from a controller acting as an exporter to a processor acting as an importer, leaving no ready-made instrument for controller-to-controller, processor-to-processor or processor-to-controller transfers.

The draft expands the scope of the SCCs to cover all four relationships — controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller — mirroring the EU's modular SCC model, and adds an express duty on the commissioner to draft and publish them in line with European practice.

Sanctions still modest, still no turnover percentages

In terms of sanctions, the draft does not introduce EU General Data Protection Regulation-level fines. The maximum fixed fine for legal entities remains unchanged at RSD2 million; only the floor rises, from RSD50,000 to RSD200,000.

There is no percentage-of-turnover mechanism and no caps. The only new mechanism is a proportionality multiplier, up to 20 times the damage caused or the value of the unfulfilled obligation, capped at five times the highest prescribed fine — roughly 85,000 euros — and it applies only where a quantifiable harm or obligation exists.

The commissioner, remedies and a biometric ban

The draft reworks the remedies approach, separating a "complaint" concerning the exercise of data subject rights from a broader "petition" alleging a breach of the law, and it applies the general administrative procedure to complaints with a 60-day decision deadline, a change from the current reliance on the inspection-oversight framework.

The draft adds a prohibition on remote, mass and indiscriminate biometric identification through video surveillance systems, a restriction with no equivalent in the 2018 law.

Next steps

With consultation open until 10 Sept., provisions may still be added, changed or dropped. The draft moves toward closer alignment with the GDPR framework, expansion into AI and video surveillance and a sanctions regime that, for now, stops well short of GDPR bite.

Search resources

All IAPP resources

Filter results

Resource type

Subject

Industry

Law and regulation

Domain

Serbia's draft Personal Data Protection Law: What changes are on the table