Data ProtectionData Protection Representative for Serbia

Practice area

Data Protection Representative for Serbia

A local contact point in Serbia for the Commissioner and data subjects, for companies with no establishment here that offer services to or monitor individuals in Serbia.

If your company has no business presence in Serbia but processes the personal data of individuals here, in many cases you are obliged to appoint a Data Protection Representative.

The Representative is a local natural person or legal entity, formally authorised to represent you in data protection matters and available to the Commissioner and to data subjects.

The obligation usually applies where you offer goods or services to individuals in Serbia, including free services, or monitor their activity through cookies, analytics, profiling or targeted advertising.

There is no obligation for public authorities, or where processing is occasional, does not involve large-scale special categories or criminal conviction data, and is unlikely to pose a risk to rights and freedoms.

What we handle

Six areas the appointment covers.

Data subject requests and communication

Receipt and handling of requests for access, deletion and objection.
Communication with the Commissioner on your behalf.
Defined response deadlines and multi-channel availability.

Transparency and published contact details

Publication of the Representative’s identity and contact details, usually in the privacy policy and on the contact page.
Review and alignment of privacy notices so the local contact appears where data subjects look for it.

Records of processing activities

Maintenance of the RoPA where required — 250+ employees, high-risk processing, non-occasional processing or special categories of data.
Technical assistance with documentation, on the controller’s instructions.
Access to the information the Representative needs to perform the role.

Cooperation in supervision and proceedings

Cooperation with the Commissioner during oversight and proceedings.
Preparation of responses and coordination of evidence.
Timely provision of the information requested.

Onboarding and authorisation

Service agreement and power of attorney, with roles clearly defined.
Dedicated communication channels and service levels.
Fast appointment so the obligation is met without delay.

Cross-border coordination

Synchronisation with your EU or UK representative and your DPO.
Aligned messaging to supervisory authorities across jurisdictions.
Service scaled to startups, scale-ups or corporate groups.

How we work

What working with us looks like

Five steps, from the obligation assessment to ongoing support.

Obligation assessment

Screening under the Serbian Data Protection Act and the Commissioner’s practice.

Contracting and appointment

Power of attorney, contact points and service levels agreed.

Communication channels

A dedicated address set up and the privacy notice updated with the Representative’s contact.

Documentation and records

Where required: RoPA and procedures for handling data subject requests.

Ongoing support

Regular review of compliance in communication and cooperation with the Commissioner.

Track record

Selected matters

A sample of recent work in the sector.

Scope

Representative office in Belgrade

Where a registered office is used for actual and stable operations, a separate Representative is generally not required — we review the specific case.

Liability

Who remains responsible

Complaints and claims are directed at the controller or processor. The Representative is a contact point and intermediary, not a shield from liability.

EU market

Article 27 representative

Where you target or monitor individuals in the EU, an EU representative is usually required in a Member State, subject to the same exemptions.

Risk

Failure to appoint

Beyond reputational risk and obstructed cooperation with the authority, misdemeanour proceedings and fines under the Act are possible.

Related work

Other practice areas

Data Protection External DPO Information Security & Regulatory Alignment Crypto & Web3 Artificial Intelligence Law

What Clients Ask Us Most

Can a law firm act as Representative for Serbia?

Yes. The law allows the representative to be a natural person or a legal entity with residence or seat in Serbia, and data protection expertise is advisable for the role to be performed properly.

Is the Representative the same as a DPO?

No. A DPO is an independent function that advises and monitors compliance; the Representative is a local contact point for external communication and handling of requests in Serbia.

The Representative does not monitor compliance — the role is accessibility and communication.

Do we have to publish the Representative’s contact details?

Yes. The identity and contact details must be published transparently so the Commissioner and data subjects can make contact, most commonly in the privacy policy and on the contact page.

We have a registered representative office in Belgrade. Do we still need one?

If the office is used for actual and stable operations, the usual position is that a separate Representative is not required. We recommend reviewing the specific business model, contracts and data flows.

Is the Representative liable for breaches?

Primary responsibility stays with the controller or processor. The Representative is a contact point acting on instructions; complaints and claims are directed at the controller.

We also operate in the EU — do we need an EU representative?

If you target individuals in the EU or monitor their behaviour, Article 27 GDPR usually requires an EU representative, unless an exemption applies.

Can the Representative keep records on our behalf?

Yes, where you delegate it and the criteria for mandatory records are met. In any case the Representative must have access to the necessary information.

Next step

Let’s check whether you need one

Send us a short description of your business model and processing in Serbia and you will get a quick assessment and a step plan.

From the blog

Learn legal updates, and what to do about them

Legal developments in Serbia and the EU, each with the step it asks of your business.

Two emails a month. Unsubscribe any time.