Under the previous data protection law, the DPA’s prior approval was a precondition for a legitimate data transfer whenever a transfer was to be made to any country which had not signed and ratified the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ("Relevant Convention"). The data transfer regime has now been completely revamped and liberalized under the DP Law, which is a much-welcomed change from the previous overly restrictive concept. The DP Law explicitly applies to both direct and indirect data transfers, unlike the previous law for which it was not fully clear whether it covers indirect transfers at all.

This means that, under the DP Law, substantially the same as under the GDPR, there is a whole set of mechanisms enabling legitimate data transfer out of Serbia. Specifically, subject to circumstances of each particular case, controllers will be entitled to transfer personal data abroad if one of the following situations (among others) occurs:

• Personal data is to be transferred to a country that ratified the Relevant Convention.
• Data transfers are to a country included on the Serbian government’s list of countries providing an adequate level of data protection (EU Countries, other countries which are member states of the Relevant Convention and some other countries such as, for example, Canada (for business subjects only) and Japan).
• Data transfers are performed to a country which has a bilateral agreement with Serbia regulating data transfers.
• The transfer is based on the standard contractual clauses prepared by the Serbian DPA.
• The transfer is based on binding corporate rules or a code of conduct approved by the Serbian DPA, or on certificates issued in accordance with the law.
• The Serbian DPA has issued a specific approval for the transfer to be performed on the basis of an agreement between the data exporter and the data importer.
• The data subject has explicitly consented to the proposed transfer, after having been informed on the possible risks.

This should create more options for the transfer of data to non-European countries, especially since the DPA has prepared the aforementioned standard contractual clauses, which are adopted and applicable as of 30 January 2020 (keeping however in mind that, under the DP Law, the respective SCC mechanism will be available only when a data importer is a data processor). In addition, when it comes to the process of obtaining the DPA’s aforementioned specific approval for a data transfer, such procedure should be completed within 60 days, as explicitly prescribed under the DP Law.