Meet Serbia's ZZPL data protection law with less manual work

The Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, ZZPL) is Serbia's main data protection law, published in the Official Gazette of the Republic of Serbia No. 87/2018. It is closely modelled on the EU GDPR and sets out processing principles, lawful bases, data subject rights, controller and processor duties, breach notification, international transfers and the powers of the Commissioner, across 102 articles.

The law was published in November 2018 and entered into force on the eighth day after publication, but under Article 102 it only began to apply nine months later, in August 2019. From that point it replaced Serbia's previous 2008 data protection law, which ceased to be in force, and organisations were expected to have their processing aligned with the new rules.

Any controller or processor established in Serbia must comply when processing personal data in the context of its activities there, wherever the processing physically happens. Under Article 3, organisations outside Serbia are also covered when they offer goods or services to people in Serbia or monitor their behaviour there, and they may need to appoint a representative in Serbia under Article 44.

Article 95 sets misdemeanour fines of RSD 50,000 to RSD 2,000,000 for controllers and processors that are legal entities, for breaches such as unlawful processing, processing without valid consent or failing to notify breaches. Responsible individuals within an organisation can also be fined. The Commissioner can additionally order corrective measures, and data subjects can claim compensation for damage under Article 86.

The Serbian law follows the GDPR very closely, often almost word for word: the same principles, lawful bases, data subject rights, DPO rules, DPIAs, 72-hour breach notification and transfer mechanisms. The main differences are its article numbering, misdemeanour fines set in Serbian dinars rather than turnover-based fines, and added chapters on processing by competent authorities, mirroring the EU Law Enforcement Directive.

Yes. Under Article 52, a controller must notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of a breach that may create a risk to individuals' rights and freedoms. Under Article 53, it must also inform affected data subjects without undue delay where the breach is likely to result in a high risk to them.

Not automatically, but it gives you a strong head start. A GDPR programme already covers most of the same obligations, and ISO 27001 controls support the security of processing duty in Article 50. You still need to check Serbia-specific points such as a local representative, the Commissioner as breach recipient, transfer rules under Articles 63 to 71 and Serbian-language notices where relevant.

The Serbian Law on Personal Data Protection is mapped in OneClickComply's control library and is available on request. Because controls are shared across frameworks, evidence you already collect for GDPR or ISO 27001 can count towards it. Speak to our team to enable it for your account, and use Ask an Auditor for guidance on Serbia-specific obligations.