Page 1

Decree on the form for keeping records and the manner of keeping
records on the processing of personal data
("Official Gazette of RS", No. 50/2009)
AND BASIC PROVISIONS
Article 1
This decree prescribes the form for keeping records on processing and the manner
keeping records on the processing of personal data.
The form referred to in paragraph 1 of this Article is printed together with this Decree and forms its integral part
a part of.

Article 2
Entering personal data in records and other tasks related to
the records are kept by the personal data controller (hereinafter: the controller),
in accordance with the law.

Article 3
Records of personal data can be kept manually or by means of
automatic data processing, unless otherwise provided by a special law.

Article 4
The records of personal data also contain data on the date of the previous one
notices of the establishment of a collection of personal data, the date of the first
reporting the records and the date of the amendment of the records.

II CONTENTS OF RECORDS
Article 5
Records on the processing of personal data, in accordance with the law, contain data on:
the types of personal data on which records are kept and the name of the data collection on
personalities (hereinafter: data collection); types of processing operations; name, name,
the seat and address of the operator; the date of commencement of processing, ie establishment
databases; processing purposes; the legal basis of processing or establishment
databases; the category of persons to whom the personal data relate; types and
the degree of secrecy of personal data; how to collect and store data on
personalities; period of storage and use of personal data; name, name, seat and
addresses of users of personal data (hereinafter: users); mark
entering, ie exporting personal data from the Republic of Serbia with the name
states, ie international organizations and foreign users; legal basis and
the purpose of entering or exporting personal data; measures taken
protection of personal data and request regarding processing.
In addition to the data referred to in paragraph 1 of this Article, records on the processing of personal data
it also contains an ordinal number and a note.

Type of personal data and name of the data collection

Page 2

Article 6
Data on the type of personal data contains a list of all types of personal data
contained in the processing records.
List of types of special categories of personal data contained in the records of
processing is stated separately.
If the name of the database is not determined by a special law, the name determines
handler of a special decision which determines the manner and purpose of data processing on
personalities.

Name, name, registered office and address of the operator
Article 7
The name, registered office and address of the operator who is a legal entity must match
the registered name, registered office and address of that person entered in the register.
If the operator is a natural person, the name and address must match the personal name and
addresses of residence of that person.
If the controller is a public authority, in terms of the Law on Personal Data Protection,
the name and registered office must correspond to the name determined by law or other regulations
and the seat of that body.

Purpose of processing
Article 8
Data on the purpose of processing contain a description of the purpose for which personal data are collected
into a specific database, indicating whether the purpose of the processing is determined by law or
is determined by the controller with the consent of the person to whom the data relates,
that is, another authorized person.

Legal basis for processing, ie establishing a data collection
Article 9
Data on the legal basis of processing, ie the establishment of a data collection, which are
collect and process with the consent of the person to whom the personal data relate,
that is, the authorized person, contain a mark on the manner of giving consent.
For collecting and processing personal data, in cases determined by law
or another regulation, the provision of the law or regulation determining it shall also be stated
data collection.

Category of persons to whom personal data refer
Article 10

Page 3

Data on the categories of persons to whom the personal data refer contain a label
groups or groups of persons to whom the data relate.

Type and degree of data secrecy
Article 11
Data on the type and degree of secrecy of personal data contain the designation of type i
degree of data secrecy, in accordance with the regulations governing the determination of and
protection of classified information.

Method of data collection and storage
Article 12
Data on the manner of collecting personal data are indicated by citation
sources of obtaining data (directly from the person to whom it refers, by taking over from
other data collections, by collecting from another person or from other sources that are
must be specified in the records).
The notification on processing contains data on notifying the persons to whom the data on
persons relate, ie another person, about the processing of data, which were given before
their collection.
The method of storing personal data contains an indication of the form in which the data is
expressed, as well as the designation of the information carrier on which the data is stored.

Data retention and use period
Article 13
Data on the retention period and use of personal data contain the date
establishing a data collection and deadlines for storing and using data on
persons determined by law or other regulation.
If the time of use of personal data is not determined by law or others
by regulation, the deadline necessary for achieving the purpose is entered in the records
the processing for which the personal data were collected.
Records from para. 1 and 2 of this Article also contain a mark on deleting data on
persons after the expiration of the period for storage and use of data.

Name, name, registered office and address of the user
Article 14
It applies accordingly to the name, name, registered office and address of the user
provision of Article 5 of this Decree.

Page 4

Indication of entering or exporting personal data from
republic of Serbia
Article 15
Mark of entering or exporting personal data from the Republic of Serbia
contains data on the fact of entering, ie presenting personal data, with
the name of the state, ie international organization and foreign data user
on the person, as well as the purposes of entering or exporting personal data with
legal basis, ie an indication of the consent of the person to whom the personal data are transferred
relations or an authorized person.

Personal data protection measures taken
Article 16
The label of the measures taken to protect personal data contains information on which ones
organizational, personnel and technical protection measures have been taken.

Request regarding processing
Article 17
The processing request code contains information on the name, name, registered office and address
of the applicant, the date of submission of the request and the type of request (request for
notice, insight or copy).

Obligation of the record keeping manager
Article 18
The operator who educates and keeps the records referred to in Article 5 of this Decree is obliged to, in
in accordance with the law, keeps up-to-date records and checks whether the situation is according to the book
agrees with the actual situation.
In case of change of the basic data from Article 5 of this Decree about which it is kept
records, the operator is obliged to update the records within 15 days from the day
the occurrence of the change, in accordance with the law.
Regulations apply accordingly to keeping records on the processing of personal data
on office operations in state administration bodies.

III FINAL PROVISION
the entry into force
Article 19
This Regulation shall enter into force on the eighth day following that of its publication in the Official Journal of the European Union
Gazette of the Republic of Serbia ".

Form for keeping records on data processing on
personalities

Page 5

The terms used in this form have the meaning determined by the Law on
protection of personal data ("Official Gazette of RS", No. 97/08) and this regulation.
This record refers to:
1) prior notification of the intended establishment of data records on
personalities. Date of submission of prior notice _______________.
2) first reporting of records on personal data - record number:
_______________.
3) amendment, ie supplement to the record number _______________.
Date of submission of changes, ie additions to the records _______________.

1

Serial number

2

Type of personal data and name of personal data collection

3

Type of processing operation

4

Name, name, registered office and address of the operator

5 Date of commencement of processing, ie establishment of records on processing
6

7

Purpose of processing (state whether the purpose is determined by law or determined
by the controller, with the consent of the person to whom the personal data are transferred
relations)
Legal basis for processing, ie establishing data records
(with the name and provisions of the law)

8

Category of persons to whom personal data refer

9

Type and degree of secrecy of personal data

1
0

The way of collecting and storing personal data
(with indication of the designation of origin of the data and the data on informing the person on
which data relate)

1
1

Shelf life and use of personal data
Name, name, registered office and address of the user

1
2
1
3

Mark of data entry, ie export from the Republic of Serbia with
the name of the state, ie international organization and foreign user,
legal basis and purpose of data entry or export

1
4
1
5

Personal data protection measures taken
(organizational, personnel and technical)
Request regarding processing
(with the name, name, seat and address of the applicant, date
submission of requests and types of requests

Page 6

1
6
Record handler:
_________________

Note

