Skip to content
Home/Data protection & GDPR

Working with a Serbian development partner under the GDPR

HOW MUCH Labs is registered in Belgrade, Serbia. Most of our clients are in the EU. This page explains exactly what that means for your personal data — including the part that is not automatic.

Written for the person at your organisation who has to sign off on a processor outside the EEA.

The short answer

Three facts, in the order they matter

01

Serbian law is modelled on the GDPR

Serbian data-protection law is closely modelled on the GDPR. The Law on Personal Data Protection (LPDP) was adopted in 2018 and has applied since 21 August 2019. It reproduces many of the GDPR’s core principles, legal bases, controller/processor obligations and data-subject rights, although the two regimes are not identical. A draft replacement law was published for public consultation in July 2026; until a new law applies, the LPDP remains the applicable law.

02

Serbia has no EU adequacy decision

Serbia does not currently benefit from a European Commission adequacy decision. Any restricted transfer of personal data from the EEA to us therefore needs a valid Chapter V transfer basis. For our typical processor engagements, that basis is the EU Standard Contractual Clauses (SCCs); the narrow Article 49 derogations are not suited to ongoing, repetitive transfers such as development work.

03

Transfer safeguards come first

Where an engagement involves a restricted transfer of personal data to us, we put the applicable transfer safeguards in place before the transfer begins. For our typical processor engagements, we sign the relevant 2021 EU SCC module, document the processing terms (including an Article 28 DPA where used), and provide the information needed for the exporter’s transfer assessment. If that assessment identifies a need for supplementary measures, those measures must also be addressed. This is a legal safeguard framework, not a substitute for the exporter’s own assessment.

The law that applies to us

Serbia’s data protection law is modelled on the GDPR

The Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "LPDP") was adopted on 9 November 2018 and has applied since 21 August 2019. It was drafted as part of Serbia’s EU accession obligations, and it closely follows the GDPR’s concepts — principles, legal bases, data subject rights, privacy by design, breach notification, DPIAs, data protection officers and transfer rules.1,2 (Sources)

It also incorporates rules from the EU Law Enforcement Directive (2016/680) into the same provisions that govern ordinary processing, which is why it is organised differently from the GDPR.3,4,11 (Sources)

GDPR concept → treatment under Serbian law
The instrument
Law on Personal Data Protection (LPDP)

Official Gazette of the Republic of Serbia No. 87/2018. Adopted 9 November 2018, in force from 21 November 2018, applicable from 21 August 2019. A draft replacement law was published for consultation in July 2026.

Supervisory authority
Commissioner for Information of Public Importance and Personal Data Protection

Independent authority with investigative, advisory and corrective powers, including warnings, orders to remedy irregularities, temporary processing bans and orders to delete unlawfully collected data. It can itself impose only a fixed fine for certain misdemeanours; all other fines are imposed by the misdemeanour courts (prekršajni sud).

Lawful bases
Closely aligned

Consent, contract, legal obligation, vital interests, public interest and legitimate interests — the same six grounds as GDPR Article 6.

Special categories of data
Closely aligned

Processing generally prohibited, subject to a narrow set of exceptions comparable to those in GDPR Article 9.

Data subject rights
Closely aligned

Access, rectification, erasure, restriction, portability, objection and protection against solely automated decision-making.

Controller / processor
Closely aligned

A controller/processor distinction comparable to the GDPR’s (Article 4), and a comparable requirement for a written processing agreement between them (Article 28).

Breach notification
Closely aligned

Notification to the Commissioner without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals; notification to affected data subjects where the risk to them is high.

DPIA and data protection officer
Closely aligned

Impact assessments for high-risk processing; data protection officers required in comparable circumstances.

International transfers
Closely aligned, with a Serbian list

Transfers to Convention 108 parties and to countries on the Serbian Government’s adequacy list; otherwise safeguards such as standard contractual clauses issued by the Commissioner (currently usable only where the importer is a processor), binding corporate rules, codes of conduct and certification.

Article numbering differs between the two instruments and the LPDP is structured differently, so this table maps concepts rather than citing article numbers. For the operative text, see the law itself in the references below.

Where it differs

Compatible is not identical

A page that claimed perfect equivalence would be wrong, and the differences are the first thing a competent DPO will ask about. Here they are.

No recitals

The GDPR’s 173 recitals are the main interpretive aid for its operative text. The LPDP has none. Court case law on it is still limited, although the Commissioner’s published supervisory and complaints practice has grown considerably.2,3 (Sources)

What it means for you

Serbian practitioners consult the GDPR’s recitals and EDPB guidance when interpreting the LPDP, even though neither is a formal source of Serbian law — so interpretation tends to converge on the EU position rather than drift from it.

A different transfer list

Serbian law treats parties to Convention 108 as providing adequate protection, and the Serbian Government has adopted its own adequacy list: EU and EEA states, the other Convention 108 parties, and some further countries such as Canada (business entities only) and Japan. Because it includes Convention 108 parties that have no EU adequacy decision, such as Türkiye, it is not identical to the EU’s list.5 (Sources)

What it means for you

Relevant only to onward transfers. If your data must never leave the EU/Serbia pair, say so in the DPA and we will contract to it.

Enforcement is lighter

Fines under the LPDP are far lower than under the GDPR: for a legal entity, the statutory range is RSD 50,000 to RSD 2,000,000 (roughly €430 to €17,000). The Commissioner can itself impose only a fixed fine of RSD 100,000 (about €850) for certain misdemeanours; all other fines are imposed by the misdemeanour courts (prekršajni sud), typically at the Commissioner’s request.3,5 (Sources)

What it means for you

It is a fair reason to rely on contractual remedies rather than on regulatory deterrence alone — which is exactly what SCCs are for.

Sectoral laws are not fully aligned

The LPDP required other laws to be aligned with it by the end of 2020 (Article 100), and that work is not complete. Serbia’s 2023–2030 Data Protection Strategy acknowledges that legislation affecting personal data is not yet fully harmonised with the LPDP and identifies further alignment with EU standards, including work toward an EU adequacy decision, as a policy objective.2,9 (Sources)

What it means for you

The relevance of sector-specific Serbian rules depends on the type of data and project; regulated areas such as employment, health, finance, telecommunications or the public sector may require additional analysis.

Transfers EU → Serbia

Serbia has no adequacy decision. Here is how a restricted transfer is typically handled.

Under Chapter V of the GDPR, transfers of personal data outside the EEA require a valid transfer basis. An adequacy decision is one route; Article 46 safeguards such as SCCs are another, and Article 49 contains limited derogations for specific situations.10 (Sources) Serbia is not on the EU adequacy list.7 (Sources) For our ordinary ongoing processor engagements involving EEA personal data, the relevant route is normally the 2021 EU SCCs.

This is the same mechanism EU companies commonly use with non-EEA suppliers. It is routine work, not an obstacle — but where a restricted transfer is involved, it has to be done, and done before data moves.

1

We establish whether personal data is needed at all

A large share of development work can be done with truly anonymised data or non-personal synthetic fixtures. Where pseudonymised personal data is sufficient, we prefer it to directly identifiable production data because it reduces risk; however, pseudonymised data remains personal data where individuals can be re-identified, so the GDPR and applicable transfer safeguards still apply. If no personal data is transferred at all, Chapter V does not apply to that work.

2

You sign a processor agreement with us

For our typical processor engagements, we document the processing terms in an Article 28 DPA where used. It covers the subject matter, nature, purpose and duration of the processing; the categories of data and data subjects; processing only on your documented instructions, including with regard to transfers; confidentiality obligations for everyone with access; our security measures; the rules on sub-processors; our assistance with data subject requests and with your security, breach-notification and impact-assessment obligations; your audit and information rights; and what happens to the data at the end of the engagement. We are content to work from your template. Modules Two and Three of the 2021 SCCs already contain Article 28 clauses; we sign a separate Article 28 DPA when you want the processing terms in one document.

3

We sign the EU Standard Contractual Clauses

The Commission’s 2021 SCCs (Implementing Decision (EU) 2021/914) use Module Two for controller-to-processor transfers and Module Three for processor-to-processor transfers. They provide the Article 46 safeguards for those scenarios, provided the parties also meet the SCCs’ own requirements — including the Clause 14 assessment described in the next step.8 (Sources)

4

We support your transfer impact assessment

Under Schrems II, the exporter carries primary responsibility for assessing whether the destination country’s law and practice undermine the SCCs. Under Clause 14 of the SCCs, both parties warrant that this assessment has been made, and we, as importer, must make our best efforts to give you the relevant information and notify you promptly if a change in law or practice could prevent us from complying with the SCCs. We answer questions on Serbian law, government access powers and our own technical and organisational measures in writing, so the assessment is documented rather than assumed. If it identifies a need for supplementary measures, those measures must be agreed and in place before the transfer starts.8 (Sources)

Data flowing the other way is simpler

Serbian law treats EU member states as providing an adequate level of protection, so transfers from us back to you — returning a database, handing over a repository, restoring a backup to your infrastructure — need no additional mechanism under the LPDP.5 (Sources)

International commitments

Serbia has ratified the Convention 108+ Protocol

Serbia is a party to the Council of Europe’s Convention 108 and its Additional Protocol on supervisory authorities and transborder data flows (ETS No. 181), and ratified the Protocol modernising the Convention (CETS No. 223, commonly referred to as Convention 108+) on 26 May 2020, as the fourth state to ratify it. The Protocol has not yet entered into force: as of 27 August 2026 it had 34 ratifications, while 38 are required under its entry-into-force rule. Serbia is therefore bound by the existing Convention 108, and has ratified — but is not yet bound by an in-force Convention 108+ Protocol.6 (Sources)

This matters for two reasons. Convention 108 is a binding international obligation for Serbia, separate from its domestic legislation, and the GDPR explicitly names accession to Convention 108 as a factor the European Commission should take into account when assessing adequacy (Recital 105; see also Article 45(2)(c)).10 (Sources)

It does not, by itself, create adequacy. The safeguards described above still apply.

Status at a glance
EU member stateNo
EEA memberNo
EU candidate countryYes
European Commission adequacy decisionNot granted
Convention 108 (ETS 108)Party (incl. Additional Protocol, ETS 181)
Convention 108+ Protocol (CETS 223)Ratified 2020 (not yet in force)
GDPR-modelled national lawYes, since 2019 (draft replacement published 2026)
Independent supervisory authorityYes
In practice

What this looks like on an actual project

Most development work does not need production personal data at all. Where it does, these are the working rules.

Minimise

Anonymised data by default

We ask for a sanitised database dump or synthetic fixtures before we ask for production data. In most builds that is enough for the whole engagement.

Locate

You choose where data sits

Development, staging and production hosting can be kept within the EU, on your infrastructure or a provider you nominate. This can reduce data-location and onward-transfer risk, but it does not by itself remove the Chapter V transfer issue: remote access to personal data by our Serbia-based personnel is itself a transfer to a third country and is covered by the same transfer safeguards.

Restrict

Named access only

Access to any environment holding personal data is limited to the people actually working on your project, removed when they stop, and revoked in full at handover.

Sub-process

Sub-processors by authorisation

We disclose sub-processors that would process personal data on our behalf and use them only under the authorisation model agreed with you. Where you give general written authorisation, we give advance notice of intended additions or replacements so you have the opportunity to object in accordance with the applicable DPA/SCC terms.

Respond

Assistance with data subject requests

If an access or erasure request reaches you and the data sits in a system we built, we help you answer it within your statutory deadline. If a request reaches us directly, we pass it to you promptly and do not answer it ourselves unless you authorise us to.

Exit

Deletion on request

At the end of an engagement we return or delete all personal data we processed on your behalf, including any copies, as you instruct, and confirm it in writing.

If you are an agency

When we work behind an agency’s brand, a common structure is that the agency’s client is the controller, the agency is a processor, and HOW MUCH Labs is a sub-processor. The actual roles must be determined from who decides the purposes and essential means of each processing activity. Where we act as your sub-processor, we accept the applicable flow-down obligations and can be named in your sub-processor register.

How partnering works →
Sources & references

Check any of this yourself

Primary sources and the professional commentary the summaries above draw on.

  1. 1
    Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti)
    Official Gazette of the Republic of Serbia No. 87/2018. The primary legislation. Published with by-laws and guidance by the Commissioner for Information of Public Importance and Personal Data Protection.
    poverenik.rs — Commissioner’s office (opens in a new tab)
  2. 2
    IAPP — The state of Serbia’s Personal Data Protection Law after two years
    Practitioner assessment of how closely the LPDP mirrors the GDPR, and of the interpretive gap created by the absence of recitals.
    iapp.org (opens in a new tab)
  3. 3
    Chambers — Data Protection & Privacy 2026: Serbia
    Current country guide covering the LPDP (which the guide calls the PDPA): its alignment with the GDPR and the Law Enforcement Directive, the Commissioner’s powers and fines, and the scope of its extraterritorial reach.
    practiceguides.chambers.com (opens in a new tab)
  4. 4
    CMS Expert Guide — Impact of the GDPR in Serbia
    Comparative overview of the LPDP (which the guide calls the PDP Act) against the GDPR, including controller/processor roles, special categories of data and the law’s mix of GDPR and Law Enforcement Directive rules. Last updated April 2021.
    cms.law (opens in a new tab)
  5. 5
    DLA Piper — Transfer of personal data in Serbia
    Summary of the LPDP transfer regime, including Serbia’s adequacy list and the Commissioner’s standard contractual clauses.
    dlapiperdataprotection.com (opens in a new tab)
  6. 6
    Council of Europe — Convention 108 and Protocol CETS 223
    Treaty texts and the chart of signatures and ratifications. Serbia ratified the modernising Protocol on 26 May 2020, as the fourth state to do so. As of 27 August 2026 the Protocol had 34 ratifications; 38 are required for entry into force, so it is not yet in force.
    coe.int — CETS 223 (opens in a new tab)coe.int — Moldova becomes the 34th state to ratify (15 May 2026) (opens in a new tab)
  7. 7
    European Commission — Adequacy decisions
    The official list of countries and organisations covered by an EU adequacy decision, and the adoption procedure. Serbia does not appear on it.
    commission.europa.eu (opens in a new tab)
  8. 8
    Commission Implementing Decision (EU) 2021/914 — Standard Contractual Clauses
    The current EU SCCs, including Module Two (controller to processor) and Module Three (processor to processor), Clause 14 assessment requirements, the Clause 8.5 and Clause 10 obligations on deletion and data subject requests, and the Article 28 clauses incorporated in those modules.
    eur-lex.europa.eu — 2021/914 (opens in a new tab)
  9. 9
    Schoenherr — Serbia’s Data Protection Strategy 2023–2030 unveiled
    Analysis of the government strategy that sets an EU adequacy decision as a policy objective and identifies remaining gaps in current legislation.
    schoenherr.eu (opens in a new tab)
  10. 10
    Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)
    The regulation itself: Article 4 definitions, Article 28 processor terms, Article 33 breach notification, the Chapter V transfer rules (Articles 44–50), and Recital 105 on Convention 108 as an adequacy factor.
    eur-lex.europa.eu — 2016/679 (opens in a new tab)
  11. 11
    Ministry of Justice of the Republic of Serbia — Draft Law on Personal Data Protection (2026)
    Draft replacement for the LPDP, published on 30 July 2026 for public consultation until 10 September 2026. Commentary: IAPP, "Serbia’s draft Personal Data Protection Law: What changes are on the table" (6 August 2026; full text for IAPP members).
    mpravde.gov.rs — public consultations (opens in a new tab)iapp.org (opens in a new tab)
Questions about data protection

Ask before you sign, not after

If your DPO or legal team needs a completed transfer impact assessment, a signed DPA, a sub-processor list or answers to a vendor security questionnaire, request it and we will complete it.

[email protected]+381 63 872 6019Full legal entity details →