Serbian data controllers and processors are legally required to appoint a DPO if they are a public authority, if their core activities involve large-scale systematic monitoring of individuals (e.g., video surveillance companies, online monitoring providers), or if their core activities consist of large-scale processing of special categories of personal data or data relating to criminal convictions. Appointment is preferred but not mandatory in other cases.
The DPO must possess expert knowledge, independence, and the ability to fulfil legal tasks. Independence is critical – the role is incompatible with positions like CEO or HR Director to prevent conflicts of interest.
Authored by Senior Associate Andrea Cvetanović from JPM’s Belgrade office, this article explains the requirements and key considerations for appointing a Data Protection Officer (DPO) under Serbian law, which closely follows the EU’s GDPR.
