Serbia
Law on Personal Data Protection (2018)
Authority
Commissioner for Information of Public Importance and Personal Data Protection
Overview
Serbia’s Personal Data Protection Law (PDPA), adopted in November 2018 and in application since August 2019, is widely regarded as one of the most GDPR-aligned frameworks in the Western Balkans . The law’s provisions are nearly identical to the GDPR, covering processing principles, data subject rights, controller and processor obligations, and DPO requirements for public authorities and large-scale processors . Cross-border transfers operate through a two-tier mechanism: transfers to countries on the Serbian Government’s adequacy list—which incorporates EU adequacy decisions and Council of Europe Convention parties—proceed without prior authorization, while transfers to non-adequate jurisdictions require appropriate safeguards such as standard contractual clauses or binding corporate rules . The supervisory authority, the Commissioner for Information of Public Importance and Personal Data Protection, holds investigative, corrective, and advisory powers mirroring those of EU DPAs, including the ability to impose administrative fines and suspend data flows . Serbia adopted a Personal Data Protection Strategy for 2023–2030 and is actively pursuing EU adequacy, though a new draft law remains under consultation as of 2026 . Organizations processing Serbian data should treat compliance as functionally equivalent to GDPR obligations.