Compliance for foreign-owned companies in Serbia
Group policies written for the EU or the US do not automatically meet Serbian requirements. Local compliance gaps are among the most common findings of inspections and audits.
Data protection
The Serbian Law on Personal Data Protection closely follows the GDPR, but has its own requirements — including records, notifications to the Commissioner for Information of Public Importance and Personal Data Protection, transfers of data abroad and, for foreign controllers, the appointment of a representative in Serbia.
Anti-money laundering
Banks, payment institutions, real estate agents, accountants, lawyers and other obliged entities must apply customer due diligence, report suspicious transactions to the Administration for the Prevention of Money Laundering and keep records. Non-compliance can lead to significant penalties.
Every case is different. Attorney Slaviša Cincarević, Belgrade — confidential consultation.
Whistleblowing and internal acts
Employers above a certain size must adopt an internal whistleblowing procedure. Serbian labour law also requires internal acts on organisation and job classification, occupational health and safety, and protection against workplace harassment.
Corporate criminal liability
A legal entity can be criminally liable for offences committed by its responsible persons for its benefit, or made possible by lack of supervision. An effective compliance system is the best protection — and a relevant factor if proceedings are brought.
A Serbian compliance review
A focused review maps group policies against Serbian law, identifies missing internal acts and registrations, and sets out a practical action plan. It is far less costly than responding to an inspection or an incident.
Legal basis: Law on Personal Data Protection; Law on the Prevention of Money Laundering and the Financing of Terrorism; Law on the Protection of Whistleblowers; Labour Law; Law on Liability of Legal Entities for Criminal Offences. Author: Attorney Slaviša Cincarević, member of the Belgrade Bar Association. Last reviewed: 29 October 2026.
This guide provides general information on Serbian law and is not legal advice for a specific case.
Frequently asked questions
Is GDPR compliance sufficient in Serbia?
It is a good basis, but Serbian law has specific requirements that must be checked separately.
Do we need a representative in Serbia for data protection?
Foreign controllers and processors that target individuals in Serbia may be required to appoint one.
How often should compliance be reviewed?
At least annually and whenever the business or the law changes significantly.
Related practice area
More guides for investors
Book a consultation
Call or send an enquiry. We respond quickly.