New Law On Personal Data Protection

The Serbian Parliament enacted the new Law on Personal Data Protection in November 2018 (published in the "Official Gazette of the Republic of Serbia" no. 87/2018), which will be applicable as of 21 August 2019 (hereinafter: the "New DP Law"). Moreover, the Serbian data protection authority (hereinafter: the "DPA") has just adopted several by-laws that further elaborate on certain rights and obligations of data controllers under the New DP Law (e.g. when there is an obligation to perform personal data protection impact assessment).

As of 21 August 2019, the New DP Law shall replace and derogate the currently applicable Law on Personal Data Protection from 2008 (hereinafter: the "Old DP Law") that caused a number of ambiguities and uncertainties in practice for market participants intending to comply with this Old DP Law to the maximum extent possible.

The long-awaited New DP Law has been enacted as part of the process of accession of the Republic of Serbia to the European Union and harmonization of the Serbian regulations with the acquis communautaire as well as for the purpose of more efficient protection of personal data in the Republic of Serbia.

Although the New DP Law reflects numerous principles envisaged under the EU General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter: the "GDPR"), and a number of its provisions are a translation of GDPR provisions, it must be noted that this is a completely new piece of legislation that is different from the GDPR in certain aspects (e.g. the New DP Law does not include recitals from the GDPR, it does not provide for enormous fines that are prescribed under the GDPR, etc.).

NOVELTIES

The New PDP Law introduced significant novelties and legislative changes in the sphere of personal data protection that commercial entities in the Serbian market will need to comply with. It is expected that implementation of the New DP Law will resolve some of the issues that the market participants were facing due to the outdated Old DP Law. Some of the novelties brought in by the New DP Law are:

Cancellation of the Central Registry kept by the DPA and a cancellation of the obligation of data controllers to register with this Central Registry all personal data bases that they keep and maintain; An obligation on data controllers and data processors to keep (internal) records on personal data processing activities if they employ 250 or more persons and/or if other prescribed conditions under the law...