The Serbian Parliament enacted the new Law on Personal Data
Protection in November 2018 (published in the "Official
Gazette of the Republic of Serbia" no. 87/2018), which will be
applicable as of 21 August 2019 (hereinafter: the "New
DP Law"). Moreover, the Serbian data protection
authority (hereinafter: the "DPA") has
just adopted several by-laws that further elaborate on certain
rights and obligations of data controllers under the New DP Law
(e.g. when there is an obligation to perform personal data
protection impact assessment).
As of 21 August 2019, the New DP Law shall replace and derogate
the currently applicable Law on Personal Data Protection from 2008
(hereinafter: the "Old DP Law") that
caused a number of ambiguities and uncertainties in practice for
market participants intending to comply with this Old DP Law to the
maximum extent possible.
