Serbia Data Protection Law (ZZPL): A Website Guide
By Nemanja Vukmirović, Lizzard Solutions. Last updated 8 November 2026. This article is general information, not legal advice.
Your website has a contact form, Google Analytics, maybe a newsletter box and a chat widget. Each of them collects personal data, and Serbia’s data protection law (ZZPL) sets clear rules for every one of them, with fines of up to 2,000,000 dinars for companies.
This guide translates the law into website terms. You will see which parts of your site it touches, what your privacy notice must say, how to handle forms and cookies, what to do after a breach, and a checklist you can work through with your developer this week.
TL;DR
- ZZPL applies to Serbian businesses and to foreign businesses that offer goods or services to people in Serbia or track their behaviour.
- At the moment you collect data, your site must tell visitors who you are, why you need the data, the legal basis, who receives it and what their rights are.
- Breaches that may put people at risk must be reported to the Commissioner without undue delay, and where possible within 72 hours.
What Is Serbia’s Data Protection Law (ZZPL)?
The Zakon o zaštiti podataka o ličnosti (ZZPL) is Serbia’s Law on Personal Data Protection, published in the Official Gazette no. 87/2018 and applied since August 2019. It regulates how businesses collect, store and share personal data, gives people rights over that data, and is enforced by the Commissioner (Poverenik). It closely follows the structure of the EU GDPR.
You can read the full text of the Law on Personal Data Protection on Paragraf. The supervisory body is the Commissioner for Information of Public Importance and Personal Data Protection, which handles complaints, inspections and breach notifications.
Key takeaway
If you run a website for Serbian customers, ZZPL almost certainly applies to you, even if you are a one-person entrepreneur (preduzetnik).
Does ZZPL Apply to Your Website?
Article 3 sets the scope. The law applies when:
- your business is registered or based in Serbia, wherever the data is actually processed (for example on a server in Germany);
- your business is outside Serbia but offers goods or services to people in Serbia, paid or free;
- your business is outside Serbia but monitors the behaviour of people in Serbia, for example through tracking and profiling.
The definition of personal data (Article 4) is broad. It covers names and emails, but also location data and online identifiers, which is why IP addresses, cookie IDs and analytics identifiers matter. Foreign companies in the second or third group generally must appoint a written representative in Serbia (Article 44), with limited exceptions for occasional, low-risk processing.
Where Does Your Website Collect Personal Data?
Most small business sites collect more than the owner realises. Here is a typical map, with the legal basis from Article 12 that usually fits each case. Your lawyer should confirm the basis for your situation.
| Website element | Personal data | Typical legal basis (Art. 12) |
|---|---|---|
| Contact or quote form | Name, email, phone, message | Steps requested before a contract, or legitimate interest |
| Newsletter signup | Email, name | Consent |
| Webshop checkout | Name, address, phone, order history | Performance of a contract; legal obligation for invoices |
| Analytics and marketing pixels | IP address, cookie IDs, behaviour | Usually consent |
| Chat widget or AI chatbot | Messages, sometimes name and email | Depends on purpose; disclose the chat provider |
| Server and security logs | IP address, user agent, timestamps | Legitimate interest (security) |
Two principles from Article 5 apply to every row: data minimisation (collect only what you need) and storage limitation (keep it only as long as you need it).
Action for today: open your own site and list every form, script and widget that touches visitor data. Delete fields you do not actually use.
What Must Your Privacy Notice Say?
Article 23 lists what you must tell people at the moment you collect their data. In website terms, that means a privacy notice linked next to every form, not just in the footer. It must include:
- your company name and contact details (and your representative or data protection officer, if you have one);
- the purpose of each processing activity and its legal basis;
- your legitimate interest, where you rely on it;
- recipients of the data, such as your hosting, email or CRM provider;
- whether data leaves Serbia, and on what safeguards;
- how long you keep the data, or the criteria for deciding;
- the rights to access, correction, deletion, restriction, objection and data portability;
- the right to withdraw consent at any time, and the right to complain to the Commissioner;
- whether giving the data is required, and what happens if someone refuses;
- any automated decision-making or profiling.
Article 21 adds that the notice must be concise, transparent and written in clear and simple language.
Action for today: compare your current privacy notice against the ten points above and mark each one present or missing.
Consent Done Right: Forms, Newsletters and Cookies
When you rely on consent, ZZPL is specific. Consent must be freely given, specific, informed and unambiguous, given by a statement or a clear affirmative action (Article 4). Under Article 15 you must be able to prove it, withdrawing it must be as easy as giving it, and you cannot make a service depend on consent that is not needed for it.
- Newsletter: use an unticked checkbox, store the date, time and form version of each signup, and add a one-click unsubscribe link to every email.
- Contact form: do not bundle marketing consent into the “send” button. Answering a request and sending promotions are separate purposes.
- Cookies and trackers: analytics and advertising cookies usually rely on consent. Cookie rules also come from electronic communications law, so ask your lawyer which exact rules apply to your setup.
Technically, “consent first” means non-essential scripts must not load until the visitor agrees. Check it in your browser’s developer tools, on the Network tab, before clicking anything.
Action for today: open your site in a private window, refuse cookies, and check whether tracking requests still go out.
Hosting, Email Tools and Automations: Your Processors
Every service that handles visitor data on your behalf is a processor: hosting, form tools, CRM, email marketing, chatbot and automation platforms. Article 45 requires a written contract, often called a data processing agreement (DPA), which can be electronic, that sets the subject, duration, purpose, types of data and the processor’s duties.
If a processor stores data outside Serbia, your notice must say so (Article 23), and the transfer needs a basis under the law’s transfer rules. Automation platforms deserve special attention because they copy form data into several other tools at once; our comparison of Zapier, Make and n8n covers where each one hosts data.
Action for today: list every vendor your website sends data to, then save each one’s DPA in a shared folder.
Security and Data Breaches: The 72-Hour Rule
Article 50 requires technical and organisational measures that match the risk. Its examples include encryption, fast restoration after incidents and regular security testing.
- serve every page over HTTPS and add the protections from our website security headers checklist;
- protect forms against bots and abuse, as described in our contact form spam protection guide;
- keep tested backups, so you can restore data after ransomware or a failed update;
- limit admin accounts, use strong passwords and two-factor login.
If a breach happens and it may create a risk for people’s rights, Article 52 requires you to notify the Commissioner without undue delay and, where possible, within 72 hours of becoming aware of it. If you miss 72 hours, you must explain why. If the risk is high, Article 53 also requires you to inform the affected people. Document every breach, even small ones.
Key takeaway
Write a one-page incident plan now: who decides, who contacts the hosting provider, who notifies the Commissioner. Seventy-two hours goes fast.
Action for today: run our free website security check to spot missing HTTPS, outdated software and weak headers.
Answering Requests: The 30-Day Deadline
Visitors and customers can ask to see, correct or delete their data, restrict or object to processing, or receive it in a portable format. Under Article 21 you must respond without delay and no later than 30 days after receiving the request. You can extend this by 60 days for complex cases if you explain why within the first 30. Responding is free unless requests are clearly unfounded or excessive.
Action for today: pick one inbox (for example privacy@ or your main office address) for data requests, and put it in your privacy notice.
Records and a DPO: What Small Businesses Need
Article 47 requires a record of processing activities. Businesses with fewer than 250 employees are exempt, unless the processing may cause a high risk, is not occasional, or includes special categories such as health data. A website that collects leads every day is arguably not occasional, so a simple record is cheap insurance.
A data protection officer (DPO) is mandatory only for public authorities, for businesses whose core activity involves regular and systematic monitoring of many people at large scale, or for large-scale processing of special categories or criminal records data (Article 56).
What Are the Fines Under ZZPL?
Article 95 sets misdemeanour fines of 50,000 to 2,000,000 dinars for companies acting as controllers or processors, and 20,000 to 500,000 dinars for entrepreneurs, for violations such as breaking the processing principles, processing without provable consent, or failing to notify a breach. The responsible person in a company can be fined separately.
ZZPL Website Compliance Checklist
Use this as a working document with your developer. Each row points to the article it comes from.
| Check | ZZPL article | Done? |
|---|---|---|
| Privacy notice linked next to every form, in clear language | Art. 21, 23 | ☐ |
| Each form collects only the fields you actually use | Art. 5 | ☐ |
| Newsletter uses an unticked box; consent is logged | Art. 4, 15 | ☐ |
| Non-essential cookies and pixels load only after consent | Art. 15 (and e-communications rules) | ☐ |
| Retention period defined for leads, orders and logs | Art. 5, 23 | ☐ |
| DPA signed with hosting, CRM, email and automation vendors | Art. 45 | ☐ |
| Transfers outside Serbia listed in the notice | Art. 23 | ☐ |
| HTTPS, security headers, backups and 2FA in place | Art. 50 | ☐ |
| One-page breach plan with 72-hour notification step | Art. 52, 53 | ☐ |
| Inbox and process for data requests within 30 days | Art. 21 | ☐ |
| Simple record of processing activities | Art. 47 | ☐ |
| Representative in Serbia appointed (foreign companies only) | Art. 44 | ☐ |
If you also serve customers in the EU, the EU GDPR may apply alongside ZZPL.
ZZPL and Your Website: FAQ
Is ZZPL the same as GDPR?
No, but it is very close. ZZPL is a separate Serbian law that closely follows the GDPR’s structure: similar principles, legal bases, rights and breach rules. It is enforced by Serbia’s Commissioner, not EU authorities, and fines are set in dinars under Serbian misdemeanour law. Many businesses must respect both.
Do I need a cookie banner on my Serbian website?
If you use analytics, advertising pixels or other non-essential trackers, you generally need visitors’ consent before they load, and a banner is the usual way to collect it. Strictly necessary cookies, such as a shopping cart session, are treated differently. Ask a lawyer which electronic communications rules apply to your exact setup.
Does a small business in Serbia need a data protection officer?
Usually not. Article 56 makes a DPO mandatory for public authorities and for businesses whose core activities involve large-scale systematic monitoring or large-scale processing of special data such as health information.
What should I do if my website is hacked?
Contain the incident, change credentials, and restore from a clean backup. Then assess whether personal data was exposed. If the breach may create a risk for people, notify the Commissioner without undue delay and, where possible, within 72 hours, and inform affected people if the risk is high. Document everything you find and do.
Not sure what your site is collecting today? Our free website audit flags forms, scripts and security gaps that matter for compliance.
Want your website checked against ZZPL?
We review your forms, cookies, vendors and security setup, and give you a prioritised fix list your developer can act on. Legal wording stays with your lawyer; the technical side is ours.
Book a free consultation