Serbian Data Protection Law: Cookies and Forms

Serbia's Personal Data Protection Law and Your Website: Cookies, Forms and the Privacy Notice

If your website has a contact form, a newsletter, orders or tools such as Google Analytics and Meta Pixel, you process personal data and Serbia's Law on Personal Data Protection (Sl. glasnik RS, no. 87/2018) applies to you. In practice that means three things: set non-essential cookies only after consent, collect only the data you need through forms, and publish a clear notice about the processing.

The law has applied since 21 August 2019 and covers small businesses and sole traders too. It is supervised by the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs). The cookie rules are in the Law on Electronic Communications (Sl. glasnik RS, no. 35/2023), which refers back to the data protection law.

This article is not legal advice. We wrote it as a team that builds websites, to explain to business owners what these laws mean for a website in practice. For your specific situation, especially if you process health data or data about children, talk to a lawyer.

Below we cite the articles of the laws we rely on, so you can check them yourself.

ServiceWebsite development

Three Places on a Website Where Data Is Processed

01Cookies and scripts

Analytics, ad pixels, embedded videos or maps. Many of them store data on the visitor's device or read data from it.

02Forms

Contact form, newsletter signup, booking, checkout. Name, email and phone number are personal data, including in the email the form sends you.

03Notice

A page that tells visitors who you are, what you collect, why, who you share it with, how long you keep it and what rights they have. Many sites call it a privacy policy.

Contact Form: Ask Only for What You Need

Article 5 of the law sets out the processing principles, including data minimization: data must be adequate, relevant and limited to what is necessary for the purpose. To answer an inquiry, a name and an email or phone number are enough. Date of birth, home address and personal ID number have no place in a contact form.

You usually do not need consent to answer an inquiry. Article 12 says processing is lawful when it is necessary to take steps at the person's request before entering into a contract, and a request for a quote is exactly that.

A newsletter is a different matter. If you want to use the email from the contact form to send offers, that is a separate purpose and needs separate consent. Leave that checkbox empty for the visitor to tick and do not tie it to sending the inquiry.

Do not forget where the form ends up. Form emails sit in your inbox and sometimes in the site database. Decide how long you keep them and delete them when they are no longer needed, because Article 5 also requires storage limitation.

What the Privacy Notice Must Say

When you collect data from the person directly, for example through a form, Article 23 of the law requires you to give them the following information at the time of collection:

The simplest approach is a separate notice page on the site and a short sentence with a link to it under every form. The notice must describe your website and your tools. A copy from someone else's site almost certainly lists the wrong purposes and recipients.

Who you are and how to contact you, and the data protection officer's contact if you have one.
The purpose and legal basis of processing, and if you rely on legitimate interest, what that interest is.
Who receives the data, for example an email service or your accountant.
Whether you transfer data to another country and on what basis.
How long you keep the data or the criteria for deciding.
The person's rights: access, correction, erasure, restriction, objection and portability.
The right to withdraw consent, where processing is based on consent.
The right to lodge a complaint with the Commissioner.
Whether providing the data is mandatory and what happens if the person does not provide it.

Who Else Sees the Data: Hosting, Analytics, Email Service

A small website rarely processes data on its own. The host stores the database, the newsletter service stores the list, analytics sends visit data. When someone processes data on your behalf, the law calls them a processor.

Article 45 requires processing by a processor to be governed by a contract or other binding act in writing, which includes electronic form. Large services usually offer a standard data processing agreement you accept in the account settings.

If the processor is abroad, that is a data transfer. Article 64 considers protection adequate in countries that are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and in countries the EU has found adequate. For other countries the law requires additional safeguards.

Make a list: which tool, which company, which data, which country. You need that list both for the notice and for the conversation with whoever maintains your website.

ServiceWebsite maintenance

Records of Processing and Fines

Article 47 requires the controller to keep records of processing activities. Businesses with fewer than 250 employees do not have to, unless the processing is likely to result in high risk, is not occasional or includes special categories of data. The Commissioner explains on its website that records are not filed in advance but made available at the Commissioner's request.

A contact form that runs every day can hardly be called occasional processing. So a short record (what, why, how long, who receives it) is a sensible step even for a small business, and it helps when you write the notice.

Fines are in Article 95. A legal entity that, for example, fails to give a person the information from Article 23 or cannot prove that consent was given faces a fine of 50,000 to 2,000,000 dinars, and a sole trader 20,000 to 500,000 dinars. The responsible person within a legal entity can also be fined.

How to Check Your Own Site in 15 Minutes

Open the site in a private browser window so there are no saved cookies. Before clicking anything on the banner, open the developer tools (F12), the Application or Storage tab, then Cookies. If you already see analytics cookies, such as ones starting with _ga, or ad pixel cookies, the site sets them without consent.

Then click reject and reload the page. Analytics and advertising cookies should not appear. Also check that there is a link at the bottom of the page that lets you change your choice.

Finally, send an inquiry through your own contact form. See which fields are required, whether there is a link to the notice under the form and whether the newsletter box is already ticked. If it is, that needs fixing.

If you run a web shop, the obligations do not stop here. We covered what the Consumer Protection Law requires for distance selling in a separate article.

GuideConsumer protection law for web shops

PackagesWebsite packages

Three Mistakes We See on Small Business Websites

01Analytics before consent

There is a banner, but Google Analytics is embedded directly in the code and runs from the first page load, whatever the visitor chooses.

02A copied privacy policy

Text from another website, with someone else's company name, tools you do not use and none of the ones you do. It tells the visitor nothing accurate about your processing.

03Pre-ticked consent

The newsletter box already checked or bundled with sending the inquiry. It is hard to prove such consent was given freely and for a specific purpose.

ContactAsk us about your website

Frequently Asked Questions About Data Protection on Websites

Do I need consent for Google Analytics?

Yes, in our reading of Article 160 of the Law on Electronic Communications. Analytics stores and reads data on the visitor's device and is not necessary for the service the visitor requested. So it loads only after the visitor clicks accept.

Do cart or login cookies need consent?

No. Article 160 of the Law on Electronic Communications exempts technical storage solely to provide a service the user explicitly requested. A cart, account login and chosen language fall under that, but list them in your notice.

Can I copy a privacy policy from another website?

We do not recommend it. Article 23 requires the notice to state your purposes, recipients, retention periods and transfers abroad. Someone else's text describes someone else's processing and is almost certainly wrong for your site.

Does a small business have to keep records of processing?

Businesses with fewer than 250 employees do not, unless processing is not occasional, carries high risk or includes special categories of data. A form that runs every day is hardly occasional, so a short record is a sensible step.

Who can I turn to if I am not sure?

For interpreting the law, a lawyer who works in data protection; official texts and positions are on the Commissioner's website (poverenik.rs). For the technical part, the banner, forms and script loading, you can ask us.