Page 1

Pursuant to Article 52, paragraph 9 of the Law on Personal Data Protection (“Official Gazette
RS ”, No. 87/18) and Article 33, paragraph 5 of the Law on Free Access to Public Information
significance ("Official Gazette of RS", No. 120/04, 54/07, 104/09 and 36/10),
The Commissioner for Information of Public Importance and Personal Data Protection issues
RULEBOOK
on the form of notification on violation of personal data and the manner of notification
Commissioner for Information of Public Importance and Personal Data Protection on Injury
personal data
Article 1
This Rulebook determines the form of notification of personal data violation (in
hereinafter: the notification form) and the manner of notifying the Information Commissioner from
of public importance and protection of personal data (hereinafter: the Commissioner) on the violation of data on
personalities.
Article 2
The notification form contains:
1) Data on the operator:
(1) the name of the operator;
(2) address and registered office;
(3) name and contact details of the person for the protection of personal data of the controller, if specified,
or information about other ways in which injury information can be obtained.
2) Data breach data:
(1) a description of the nature of the data breach, including the circumstances surrounding the breach;
(2) type of personal data;
(3) the number of persons to whom the data relate;
(4) the number of data on the person whose security has been violated;
(5) the date and time of the data security breach (if known, or as estimated).
3) Description of possible consequences of the injury.
4) A description of the measures taken or proposed by the operator.
5) Other data relevant for notification of data breach.
The notification form is printed with this rulebook and is an integral part of it.
Article 3

Page 2

The controller submits to the Commissioner a notice of violation of personal data on the form
referred to in Article 2 of this Rulebook within 72 hours of learning of the violation.
In case the operator at the time of submitting the notification to the Commissioner cannot
enters all the data, he is obliged to submit them later in the same way as he submitted them
notice.
The operator who does not act within the prescribed period, is obliged to explain the reasons
which he did not act within that period.
Article 4
Along with the notification, the operator also submits records of processing operations related to
data that have been the subject of personal data breach, and which the controller keeps in accordance with
Article 47 of the Law on Personal Data Protection (hereinafter: the Law).
The operator submits other documentation, by order of the Commissioner, or on his own
initiative.
Article 5
The controller submits a written data notification to the Commissioner,
directly or by mail.
The operator can also submit a scanned copy of the notification to the e-mail address:
povredapodataka@poverenik.rs.
Article 6
This Rulebook shall enter into force on the eighth day from the day of its publication in the "Official Gazette
Gazette of the Republic of Serbia ”, and has been applied since the day of application of the Law on Data Protection on
persons ("Official Gazette of RS", No. 87/18).

Number 021-00-10 / 2019-04
In Belgrade, May 31, 2019
Deputy Commissioner,

Page 3

Stanojla Mandić, sr

Attachment: Personal Data Violation Notification Form

1) Operator data:
(1) the name of the operator
(2) address / headquarters
(3) the name and contact details of the person for the protection of the personal data of the controller or information on
another way in which injury data can be obtained
2) Data breach data:
(1) a description of the nature of the data breach, including the circumstances surrounding the breach
(2) type of personality data
(3) the number of persons to whom the data relate
(4) the number of data on the person whose security has been violated
(5) the date and time of the data security breach, if known, or according to
estimate)
3) Description of possible consequences of the injury
4) A description of the measures taken or proposed by the operator
5) Other data relevant for notification of data breach
Attachment:

In ________, on ___________. years
For the HANDLER
______________________
Name and surname
________________

Page 4

Signature

