SERBIA Trends and Developments Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
Introduction While the legislative framework has remained formally unchanged since the entry into force of the Law on Personal Data Protection in 2019, the Commissioner for Information of Public Importance and Personal Data Protection (the “Commissioner”) has continued to develop a rich and increasingly detailed body of supervisory and complaints practice. This practice now provides meaningful guidance on how the core principles of Serbian data protection law are to be interpreted and applied in concrete situations. The Commissioner’s latest annual publication, issued in early 2026 and covering cases resolved during 2025, illustrates a clear shift away from abstract dis - cussions of compliance towards a highly fact-spe - cific and outcome-oriented approach. The focus is no longer on whether controllers are formally aware of their obligations, but on whether they can demon - strate accountability, proportionality and necessity in practice. At the same time, the Commissioner has publicly acknowledged that work on a new Law on Personal Data Protection is well advanced. This legislative activ - ity, although not yet completed, provides important context for understanding current enforcement trends: supervisory practice in 2025 increasingly anticipates stricter standards for emerging technologies, digital services and large-scale processing operations. Accountability as a Central Enforcement Benchmark From formal compliance to demonstrable compliance One of the most significant trends observed in 2025 is the Commissioner’s insistence on demonstrable accountability. Controllers are no longer assessed primarily on the basis of whether they invoke a recog - nised legal basis or cite relevant statutory provisions. Instead, they are expected to show that compliance considerations were embedded into decision-making processes before processing commenced. Across a wide range of cases, the Commissioner criticised controllers for failing to produce internal documentation explaining why a particular process - ing operation was necessary, proportionate and law -
ful. This was particularly evident in cases involving reliance on legitimate interest as a legal basis. Con - trollers were repeatedly unable to provide evidence of a prior balancing test or risk assessment, leading the Commissioner to conclude that legitimate interest had been invoked retroactively rather than as part of a structured compliance process. Consequences of inadequate documentation The absence of documentation was not treated as a purely procedural shortcoming. Instead, it was direct - ly linked to substantive violations of the principles of lawfulness, transparency and accountability. In sev - eral cases, the Commissioner explicitly stated that the failure to document assessments undermined the credibility of the controller’s arguments and prevented a meaningful review of whether less intrusive alterna - tives had been considered. This approach aligns Serbian supervisory practice more closely with EU enforcement standards, where accountability is understood as an active and ongoing obligation rather than a formalistic requirement. Employee Data and Workplace Monitoring GPS tracking and continuous monitoring Employee data processing remained a key enforce - ment priority in 2025, with particular emphasis on monitoring technologies. Several high-profile cases concerned the use of GPS systems in company vehi - cles, ostensibly for purposes such as asset protection, traffic safety and operational efficiency. The Commissioner consistently held that continuous GPS monitoring represents a serious interference with employees’ right to privacy, as it enables real-time tracking of movement and behaviour. While acknowl - edging that asset protection may constitute a legiti - mate interest in principle, the Commissioner rejected blanket or speculative justifications. Controllers were expected to demonstrate actual risks, such as docu - mented incidents of theft or misuse, and to explain why less intrusive measures would not achieve the same objectives. Legitimate interest and the employment context A recurring theme in these decisions was the inher - ent imbalance of power in employment relationships.
405 CHAMBERS.COM
Powered by FlippingBook