Serbia ZZPL
Zakon o zastiti podataka o licnosti (Sluzbeni glasnik RS 87/2018) — National Assembly of the Republic of Serbia
Also known as: ZZPL, Zakon o zastiti podataka o licnosti, Serbian Data Protection Law, Serbia 87/2018
At a glance
- Current version
- Zakon o zaštiti podataka o ličnosti (Službeni glasnik RS 87/2018)
- Published 13 November 2018. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Controllers and processors established or resident in Serbia, and those outside Serbia that offer goods or services to, or monitor the activities of, people in Serbia. source
- How it is assessed
- Controllers keep records, assess high-risk processing, appoint data protection officers in set cases and notify breaches to the Commissioner within 72 hours where feasible. source
- Authority
- A law of the National Assembly supervised by the Commissioner for Information of Public Importance and Personal Data Protection, an independent state body. source
- Enforced by
- The Commissioner supervises using inspection powers; misdemeanour fines for legal entities reach 2,000,000 dinars. source
- Last change
- None recorded yet
Serbia's personal data protection law, built on the GDPR template. It sets the lawful bases for processing, the rights of data subjects, duties of controllers and processors including data protection officers and impact assessments, rules for transfers abroad, and the powers of the Commissioner for Information of Public Importance and Personal Data Protection.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
No upcoming datesAmendments
-
Zakon o zaštiti podataka o ličnosti (Službeni glasnik RS 87/2018) Major versionCurrent text
Published on 13 November 2018; it entered into force on the eighth day after publication and applies from nine months after entry into force, replacing the 2008 law of the same name (Article 102). source
Who it applies to
The law applies to automated and filing-system processing by controllers and processors in Serbia and to foreign ones targeting or monitoring people in Serbia.
- Material scope
- Processing wholly or partly by automated means, and non-automated processing of data that form or are intended to form part of a filing system; not processing by individuals for personal or household needs (Article 3, paragraphs 1 and 2). source
- Established in Serbia
- Controllers and processors with a seat, domicile or residence in Serbia, for activities in Serbia, whether or not the processing takes place in Serbia (Article 3, paragraph 3). source
- Outside Serbia
- Controllers and processors without a seat in Serbia when processing relates to offering goods or services to, or monitoring the activities of, people in Serbia (Article 3, paragraph 4); they must appoint a representative in Serbia in writing, subject to exceptions (Article 44). source
How compliance is assessed
Controllers keep records, assess high-risk processing, appoint data protection officers in set cases and notify breaches to the Commissioner within 72 hours where feasible.
- Breach notification
- A controller must notify the Commissioner of a breach likely to create a risk to rights and freedoms without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 52). source
- Data protection officer
- Mandatory for public authorities (except courts acting judicially) and where core activities involve regular, systematic large-scale monitoring or large-scale processing of special categories or criminal data (Article 56). source
Enforcement and penalties
The Commissioner supervises using inspection powers; misdemeanour fines for legal entities reach 2,000,000 dinars.
50,000 to 2,000,000 dinars
Article 95(1), for a controller or processor that is a legal entity, for 32 listed offences, including breaching the processing principles, failing to notify a breach and unlawful transfers abroad. source
100,000 dinars
Article 95(2), for a legal entity that, for example, fails to appoint a representative in Serbia or to keep records of processing. source
5,000 to 150,000 dinars
Article 95, for the responsible person in a legal entity or public body, for the offences in paragraph 1. source
- Commissioner's powers
- The Commissioner can require information from controllers and processors and check compliance using inspection powers (Article 79). source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Serbia ZZPL (RSS)