A Quick Guide to Data Protection Regulation for Businesses in Serbia

Data protection has become an increasingly important issue for businesses operating in Serbia, particularly with the implementation of the Law on Personal Data Protection. This guide provides an overview of the legal framework surrounding data protection in Serbia and outlines the key principles and requirements that businesses must adhere to in order to comply with the law.

Legal Framework:

The Law on Personal Data Protection is the primary legal framework governing data protection in Serbia. It was adopted in 2018 and is based on the principles of the GDPR, although Serbia is not a member state of the European Union. The Law applies to all businesses and organizations that process personal data in Serbia, regardless of their size or sector.

Key Principles:

The Law on Personal Data Protection sets out a number of key principles that businesses must adhere to when processing personal data in Serbia. These include:

1. Consent: Businesses must obtain explicit and informed consent from individuals before collecting and processing their personal data.
2. Purpose limitation: Personal data must only be collected and processed for specific and legitimate purposes, and must not be used for any other purposes without the individual’s explicit consent.
3. Data minimization: Only the minimum amount of personal data necessary for the purposes of processing should be collected and processed.
4. Accuracy: Personal data must be accurate and up-to-date.
5. Storage limitation: Personal data must not be kept for longer than is necessary for the purposes for which it was collected.
6. Security: Businesses must implement appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, or theft.

Rights of Data Subjects:

The Law on Personal Data Protection also outlines the rights of data subjects (i.e. individuals whose personal data is being processed). These rights include:

1. The right to access their personal data and obtain information about how it is being processed.
2. The right to have their personal data rectified if it is inaccurate or incomplete.
3. The right to have their personal data erased (i.e. the “right to be forgotten”) in certain circumstances.
4. The right to object to the processing of their personal data for certain purposes.
5. The right to data portability (i.e. the right to receive their personal data in a structured, commonly used, and machine-readable format).
6. The right to lodge a complaint with the Serbian Data Protection Authority if they believe that their rights have been violated.

Penalties:

Businesses that fail to comply with the Law on Personal Data Protection can face significant penalties. These can include fines of up to 2% of the business’s annual turnover, or up to 10 million Serbian dinars (approximately 85,000 euros), whichever is greater. In addition, individuals who have suffered damage as a result of a business’s non-compliance with the Law can seek compensation through the courts.

Defense Strategies:

To ensure compliance with the Law on Personal Data Protection, businesses operating in Serbia should consider implementing the following defense strategies:

1. Conducting a data protection impact assessment to identify and mitigate potential risks associated with the processing of personal data.
2. Developing a comprehensive data protection policy and ensuring that all employees are aware of their responsibilities in relation to data protection.
3. Implementing appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, or theft.
4. Ensuring that all contracts with third-party service providers contain appropriate data protection clauses.
5. Providing regular training to employees on data protection issues and ensuring that they are aware of their obligations under the Law.

Conclusion:

Data protection is a critical issue for businesses operating in Serbia, and compliance with the Law on Personal Data Protection is essential in order to avoid significant penalties. By implementing appropriate defense strategies and adhering to the key principles outlined in this guide, businesses can ensure that they are protecting the personal data of their customers, employees, and other stakeholders in a responsible and legally-compliant manner.

In conclusion, data protection is a key legal and ethical obligation for businesses operating in Serbia. The Law on Personal Data Protection sets out clear principles and requirements that businesses must adhere to when processing personal data. By implementing appropriate technical and organizational measures, developing a comprehensive data protection policy, and providing regular training to employees, businesses can ensure that they are complying with the Law and protecting the personal data of their stakeholders. Failure to comply with the Law can result in significant penalties, including fines and compensation claims, so it is essential that businesses take data protection seriously and prioritize compliance in all their data processing activities.