SERBIA Trends and Developments Contributed by: Vladimir Djeric, Lena Petrovic and Katarina Radovic, Mikijelj, Janković & Bogdanović
Procedural Developments and Remedies Use of warnings and corrective measures During 2025, the Commissioner continued to rely primarily on corrective measures, such as warnings, orders to delete data and instructions to align pro - cessing with legal requirements. Monetary penalties remained relatively rare, reflecting a continued empha - sis on corrective rather than punitive enforcement. However, the detailed reasoning provided in decisions indicates a readiness to escalate enforcement where non-compliance persists or where risks to individuals are particularly high. Interaction with complaints procedures In complaints-based proceedings, the Commissioner further clarified the scope and limits of data subject rights, particularly in relation to erasure and access. Several decisions confirmed that data cannot be erased where retention is required by law or neces - sary for the achievement of legitimate processing purposes. Legislative Outlook and Future Priorities Towards a new Law on Personal Data Protection In the introductory part of the 2026 publication, the Commissioner confirmed that work on a new Law on Personal Data Protection had progressed significantly during 2025, raising expectations of imminent legisla - tive reform. Although details of the proposed amendments have not yet been made public, the Commissioner indicat - ed that the new law aims to be clearer, more precise and better adapted to contemporary technological realities, including AI and advanced digital systems. Anticipated impact on enforcement Given current supervisory trends, it is likely that future enforcement will place even greater emphasis on pro - active compliance, risk assessment and governance. Controllers operating in Serbia should therefore view 2025 enforcement practice not merely as retrospec - tive guidance, but as an indication of the standards that will be expected under the forthcoming legal framework.
consent of candidates. The Commissioner rejected these arguments, emphasising that transparency does not require the publication of all personal data contained in official documents. Rejection of consent as a legal basis In line with earlier practice, the Commissioner reiter - ated that consent is generally not an appropriate legal basis in recruitment and employment contexts. Can - didates are typically in a position of dependency, and consent obtained as a condition of participation in a procedure cannot be considered freely given. This reinforces a broader enforcement message: controllers must design transparency mechanisms that respect data protection principles, rather than attempting to justify excessive disclosure through consent. Security Measures and Organisational Compliance Technical and organisational measures Across multiple enforcement areas, the Commis - sioner placed strong emphasis on the obligation to implement appropriate technical and organisational measures. Failures to anonymise documents, restrict access or establish clear retention periods were repeatedly identified as violations. The Commissioner noted that security obligations are dynamic and context-dependent. Measures that may have been acceptable in smaller-scale or analogue environments are no longer sufficient in digital and networked contexts. Staff awareness and internal policies Several decisions highlighted the absence of internal policies or the failure to implement existing ones effec - tively. Controllers were criticised for treating compli - ance as a one-time exercise rather than an ongoing organisational responsibility. This trend suggests that future enforcement will increasingly focus on governance structures, training programmes and internal controls, rather than isolated technical failures.
407 CHAMBERS.COM
Powered by FlippingBook