Serbia’s Draft Personal Data Protection Law: Long-awaited Regulation of Video Surveillance?

In early August 2026 the Ministry of Justice published a Draft Law on Personal Data Protection intended to replace the current Law on Personal Data Protection (Official Gazette of the RS, No. 87/2018), which has been in force since 22 August 2019.

The most important changes relate to video surveillance, processing involving artificial intelligence, a more concrete risk-and-security framework, selected biometric rules, and changes to remedies and sanctions. Other than that, its worth mentioning that the maximum sanctions remained unchanged, and that the Draft introduces, among others, definitions of anonymisation, cryptographic protection, risk, management of personal-data security risks, certification body, performance of tasks in the public interest and legitimate interest, in attempt to eliminated shortcomings of the current legal framework.

Video surveillance — the most immediate practical novelty

The current law has no systematic rules on video surveillance, and such gap is one of the main reasons given for the new regulation. The Draft introduces a dedicated chapter on video surveillance. For many organizations this will be the first area that requires an immediate review of existing practice once the law is adopted.

Definition. Video surveillance is defined as a system used to monitor a specific enclosed or open area by cameras that collect and further process personal data.

General rules (Article 45). Processing by video surveillance is permitted only where it is necessary and justified for the protection of persons, property, classified information or business secrets, and only if the interests of the persons recorded do not outweigh that purpose.

The area under surveillance must be clearly marked. Footage may, as a rule, be retained for no longer than six months, unless a special law provides a longer period or the recording is evidence in a legally regulated procedure. Access to and use of footage are allowed only for the purpose that existed when the recording was made. The system must be protected against unauthorized access.

Notice (Article 46). Notice must be visible at the latest when a person enters the perimeter of recording. It must include a graphic symbol and text containing at least: (1) that the area is under video surveillance, (2) the name of the controller and (3) the controller’s contact details (telephone number, e-mail address) and a link to a website through which the data subject may obtain information relating to the processing of personal data and exercise their rights. This notice does not replace the general information duties.

Access to official and business premises (Article 47). Surveillance of access may be used where necessary for the security of persons and property, control of entry and exit, or because of the nature of work that poses an increased risk. A written decision stating the reasons is required, unless the introduction of surveillance is prescribed directly by law.

Business premises and employees (Article 48). A written decision is required unless the law itself prescribes the surveillance. Before introducing cameras inside business premises, the controller must consider whether the same purpose can be achieved by other means that interfere less with the rights of employees and other persons. The decision should record the alternatives considered and why they were inadequate. Where a representative trade union exists, it must be notified. Employees must be informed in writing before surveillance begins, and proof of that information must be retained. Surveillance may be used to monitor employees’ work only if it is necessary to protect the security of persons and property or information designated for business secrets, or other public interests that outweigh the employees’ rights.

Records of access to footage (Article 49). The controller must keep records that make it possible to establish which recordings were processed, when and how they were used or transferred, who performed the action, when, for what purpose and on what legal basis. Those records are kept for one year after the year of the entry. For surveillance of premises under Articles 47 and 48, access logs should include user identification, date, IP address and search criteria, as applicable.

Next steps

The Draft remains a proposal only. With Parliament dissolved and elections set for 25 October 2026, adoption is not imminent. We will continue to follow the status of the text and any further amendments; until a new law is enacted, the 2018 Personal Data Protection Law continues to apply.