Almost every website in Serbia needs a privacy policy. As soon as a site has a contact form, Google Analytics, a newsletter, online orders or an embedded Google map, it processes personal data, and the Serbian Personal Data Protection Act (ZZPL, Official Gazette RS, no. 87/2018) requires you to tell visitors clearly who you are, what data you collect, why, how long you keep it and what rights they have.
This guide gives you a free privacy policy template for Serbian websites that you can copy and adapt. We also explain what the law actually requires, how to match the template to the tools you use, and which mistakes we see on almost every other site.
The problem is bigger than it looks. In the RXN Digital Index 2026 we reviewed the websites of local businesses, and only 13 of 57 reachable websites (22.8%) had clearly accessible privacy information. The sample is local and not a national statistic, but it shows how often this document is forgotten.
Note: This article is a practical guide, not legal advice. The template covers a typical business website. If you process health data, children’s data, CCTV footage or do profiling, consult a lawyer.
Does your website need a privacy policy?
Almost certainly yes. Personal data is any information relating to an identified or identifiable natural person. That is not only a name: an e-mail address, a phone number, an IP address and a cookie identifier can all be personal data.
You need a privacy policy if your site has at least one of the following:
- a contact, inquiry or booking form;
- Google Analytics, Meta Pixel, Hotjar or another measurement or advertising tool;
- a newsletter sign-up;
- online sales, user accounts or comments;
- embedded third-party content such as a YouTube video, a Google map or a Facebook plugin;
- a chat widget or a CRM integration.
Even a site without a single form is rarely completely “clean”: the server it runs on records visitors’ IP addresses in its logs. So the practical conclusion is simple: if your site has visitors, it needs a privacy policy.
What a privacy policy must contain under Serbian law
The content is not a matter of style. Article 23 of the ZZPL lists the information you must provide when you collect data directly from a person, which is the case with almost every form on a website.
| Required element | What to write |
|---|---|
| Controller identity and contact | Full business name, address, tax ID (PIB), registration number, e-mail |
| Data protection officer | Contact details, if you have appointed one |
| Purpose and legal basis | Why you process data and on what basis (consent, contract, legal obligation, legitimate interest) |
| Legitimate interest | Which interest, if it is the legal basis |
| Recipients | Hosting, accounting, courier, e-mail and analytics tools |
| Transfers outside Serbia | Whether data goes to other countries and with which safeguards |
| Retention period | How long you keep data or the criteria for deciding |
| Data subject rights | Access, rectification, erasure, restriction, portability, objection |
| Withdrawal of consent | That consent can be withdrawn at any time |
| Complaint to the Commissioner | The right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection |
| Whether providing data is required | Whether it is a statutory or contractual requirement and what happens if the person does not provide it |
| Automated decision-making | Whether there is profiling or decision-making without human involvement |
The legal bases are set out in Article 12 of the ZZPL. For a typical website there are four: performance of a contract (orders), legal obligation (accounting), legitimate interest (answering inquiries, site security) and consent (newsletter, analytics and marketing cookies).
The law also requires the information to be concise, intelligible and easily accessible, written in clear and plain language. A long legalistic text nobody can read misses the point, even if it formally contains every element.
Free privacy policy template (example to copy)
The template below is written for a typical business website in Serbia: a contact form, analytics with consent, an optional newsletter and optional online sales. Replace everything in square brackets with your own details and delete the parts that do not apply to your site. If your site is aimed at visitors in Serbia, publish the policy in Serbian as well; the Serbian version of this template is in the Serbian edition of this article.
PRIVACY POLICY
Last updated: [date]
This policy explains what personal data the website [site name] ([site address]) collects, for what purposes we process it, who we share it with and what rights you have. It is prepared in accordance with the Personal Data Protection Act of the Republic of Serbia (Official Gazette RS, no. 87/2018, hereinafter: ZZPL).
1. Data controller
The controller of your personal data is [full business name], [address], tax ID (PIB): [PIB], registration number: [MB]. Contact: [e-mail], [phone]. [If you have appointed a data protection officer: You can contact our data protection officer at [e-mail].]
2. What data we collect
Data you give us: your name, e-mail address, phone number and the content of your message when you contact us through a form, by e-mail or by phone. [For online sales: delivery address, order and payment details.] [For a newsletter: e-mail address and sign-up date.]
Technical data: IP address, device and browser type, and cookie data, as described in our Cookie Policy.
We do not collect special categories of data (for example health data or religious beliefs) and ask you not to send them to us.
3. Purposes and legal basis
We process data only where there is a legal basis under Article 12 of the ZZPL: to answer your inquiry (legitimate interest or steps taken at your request before entering into a contract); to perform a contract, meaning processing orders, delivery and complaints; to comply with legal obligations such as bookkeeping; and on the basis of your consent for the newsletter and for cookies that are not necessary for the site to work. You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
4. Cookies and analytics
We use necessary cookies to make the site work. Analytics and marketing cookies [for example Google Analytics, Meta Pixel] are activated only after your consent, which you can change in the cookie settings. Details of each cookie are listed in our Cookie Policy.
5. Who has access to your data
We do not sell or rent your data. We share it only with processors that provide services necessary for the operation of the site and our business, under contracts that oblige them to protect the data: [hosting provider], [e-mail or newsletter service], [accounting agency], [courier], [analytics service]. We also disclose data to competent authorities where a regulation requires us to.
6. Transfers outside the Republic of Serbia
Some of our suppliers [name them, for example Google or the newsletter service] may process data outside Serbia. Transfers are made only to countries with an adequate level of protection or with appropriate safeguards under the ZZPL, such as standard contractual clauses.
7. How long we keep data
We keep inquiries and correspondence for [for example 12 months] after the last communication. Order and invoice data are kept for the periods required by tax and accounting regulations. Data processed on the basis of consent is kept until consent is withdrawn. After the period expires, the data is deleted or anonymised.
8. Your rights
You have the right to request access to your data, its rectification or erasure, restriction of processing and the transfer of your data to another controller, as well as the right to object to processing based on legitimate interest. You can send a request to [e-mail]. We respond without undue delay and no later than 30 days after receiving the request.
9. Complaint to the Commissioner
If you believe your data is processed unlawfully, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs.
10. Are you required to provide data
Providing data is voluntary. Without your name and contact details we cannot answer your inquiry, and without delivery details we cannot fulfil an order. We do not make decisions based solely on automated processing and do not carry out profiling that produces legal effects concerning you.
11. Security and changes to this policy
We apply technical and organisational safeguards, including an encrypted connection (HTTPS), restricted access and regular system updates. We may change this policy because of changes in regulations or in how the site works. The current version is always published on this page, with the date of the last change.
The template is a condensed version of the structure we use in RXN Legal Kit, our WordPress tool for legal pages. You can see the complete published version on our own privacy policy.
How to adapt the template to your site in 5 steps
A copied template without changes is better than nothing, but only slightly. The policy must describe what your site actually does.
- List everything your site collects. Go through every form, plugin and script. Open the site in a browser and use the developer tools to see which cookies and external scripts it loads.
- Name every supplier. Hosting, e-mail service, newsletter, analytics, courier, accounting. Each one is a recipient of data and should be listed, at least as a category.
- Set retention periods. “As long as necessary” is not a period. Write a specific number of months or a clear criterion.
- Check the legal basis for each purpose. Newsletters and marketing cookies need consent. Answering an inquiry does not need consent, but you must cover it with another basis.
- Publish and link it. The policy needs its own page (for example /privacy-policy/), a link in the footer of every page and a link next to every form that collects data.
Here is what to write for the most common tools on Serbian websites:
| Tool on the site | Data it processes | What to state in the policy |
|---|---|---|
| Contact form | Name, e-mail, phone, message | Purpose: answering inquiries; retention; who reads the messages |
| Google Analytics | IP address, cookie identifiers, on-site behaviour | Consent; Google as processor; transfer outside Serbia |
| Meta Pixel | Identifiers, pages visited, conversions | Consent; Meta as recipient; marketing purpose |
| Newsletter (Brevo, Mailchimp) | E-mail, name, opens and clicks | Consent; how to unsubscribe; service as processor |
| WooCommerce shop | Name, address, phone, order | Contract and legal obligation; courier; accounting; retention |
| YouTube and Google Maps | IP address, third-party cookies | Consent, or a no-cookie mode until the visitor clicks |
| Hosting and server logs | IP address, access time | Legitimate interest: security and operation of the site |
If you run an online shop, the privacy policy is only one of the documents you need. A shop also needs terms of sale and information on the right of withdrawal and on complaints. If you sell through Instagram, the same obligations apply to you; see our guide to selling on Instagram in Serbia.
Privacy policy and cookies: do you need two documents?
We recommend two. The privacy policy describes all processing, while the cookie policy lists each cookie in detail: name, purpose, duration and who sets it. That keeps the privacy policy readable, and you can update the cookie list whenever you add a new tool.
What the site does matters more than the text. Analytics and marketing cookies should be activated only after the visitor gives consent. Many cookie banners on Serbian sites only show a message while Google Analytics and the Pixel load immediately. That banner protects nothing.
How to check in two minutes whether your banner really blocks cookies, a cookie table for a WordPress site and a cookie policy template are in our guide to cookies and the cookie policy in Serbia. To block scripts until consent, including behind page caching, we built RXN Cookie Kit, and you can see an example document on our cookie policy page.
GDPR or ZZPL: which law applies to your website?
The ZZPL is largely aligned with the EU General Data Protection Regulation (GDPR), so the concepts and obligations are very similar. The difference is who has to apply which law:
- A Serbian business with a site for local users applies the ZZPL. Its policy should refer to the ZZPL, not only to the GDPR.
- A Serbian business offering goods or services to people in the EU, or monitoring their behaviour on the site, may also be covered by the GDPR. Its policy should then cover both.
- A foreign business offering goods or services to people in Serbia may be covered by the ZZPL and, as a rule, should appoint a representative in Serbia (Article 44 of the ZZPL).
A common mistake is a policy copied from a foreign site that mentions only the GDPR, an “EU representative” and the right to complain to “the supervisory authority in your member state”. For a visitor in Serbia the competent authority is the Commissioner, and the policy should say so.
7 most common privacy policy mistakes on Serbian websites
- “By using this website you accept the privacy policy.” This sentence appears on hundreds of Serbian sites and means nothing. Under the ZZPL, consent must be freely given, specific, informed and unambiguous. Simply browsing a site is not consent.
- Text copied from another site. Sometimes complete with the other company’s name and e-mail address. Such a document describes someone else’s processing, not yours.
- No name, tax ID or contact of the controller. Visitors must know who processes their data and whom to contact.
- The tools the site really uses are missing. The policy does not mention Google Analytics, yet analytics is running. Or it mentions a Meta Pixel that was removed two years ago.
- No retention periods. “We keep data as long as necessary” says nothing.
- Pre-ticked consent box. A newsletter checkbox that is already ticked is not consent.
- The policy exists, but nobody can find it. No footer link, no link next to the form. That is exactly what we measured in the Digital Index: on most sites, privacy information was not clearly accessible.
Who enforces it and what the fines are
The ZZPL is enforced by the Commissioner for Information of Public Importance and Personal Data Protection. The Commissioner acts on complaints but can also carry out supervision on its own initiative.
Article 95 of the ZZPL sets fines of RSD 50,000 to 2,000,000 for legal entities and RSD 20,000 to 500,000 for sole proprietors, for a range of offences that include failing to provide the required information to the people whose data is processed. The responsible person within a legal entity can be fined separately.
Fines are not the most common risk, though. Far more often it is lost customer trust, problems with advertising (Google and Meta require a privacy policy for certain ad types and integrations) and partners or investors asking you to show that you operate in line with the regulations.
When a template is not enough
The template in this article covers a typical business website. You need a more detailed policy, and often a lawyer’s advice, if you:
- process health data (clinics, pharmacies, fitness and wellness with health questionnaires);
- have children using the site or collect data about minors;
- do profiling or automated decision-making (for example customer scoring);
- run CCTV or process employee data;
- transfer data outside Serbia at scale or use many integrations.
On our clients’ WordPress sites, RXN Legal Kit generates the legal pages from a single set of company details: privacy policy, cookie policy, terms of use and a form for personal data requests. If you want us to check what your site really collects and whether your policy matches it, that is part of our website maintenance, and you can also reach us through the contact page.
FAQ: privacy policy questions
Does a small website without online sales need a privacy policy?
Yes, if it has a contact form, analytics, a newsletter or embedded third-party content. The obligation does not depend on the size of the business or on whether you sell online, but on whether the site processes personal data. Almost every site does.
Can I copy a privacy policy from another website?
You can use another site’s structure as a starting point, but not its content without adapting it. The policy must describe your business, your tools, your suppliers and your retention periods. Text copied from another site describes someone else’s data processing.
Where on the site should the privacy policy be?
On its own page, with a link in the footer of every page and a link next to every form that collects data. Visitors must be able to find it before they submit their data, not after.
Is it enough for the policy to mention only the GDPR?
No, if you are a Serbian business and the site is aimed at users in Serbia. The ZZPL applies, so the policy should refer to it and name the Commissioner as the competent authority. Mention the GDPR in addition if you target users in the EU.
Does Google Analytics require consent?
Analytics cookies are not necessary for the site to work, so they should be activated only after the visitor consents. Google Analytics should be listed in the privacy policy and the cookie policy, together with the information that data may be transferred outside Serbia.
How often should a privacy policy be updated?
Every time you add a new tool, form or supplier, and at least once a year as a routine check. The date of the last change should be visible at the top or bottom of the document.
