Serbia Law on Personal Data Protection 2018

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	RS LPDP
Region	Europe
Country or scope	Serbia
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers RS LPDP

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`RS-LPDP-50` Security of Processing	Controllers and processors must implement appropriate technical measures ensuring ongoing confidentiality, integrity and resilience of processing systems; verifiable integrity hashes on software components evidence this control (LPDP Art. 50, mirroring GDPR Art. 32)	Scan
`RS-LPDP-47` Records of Processing Activities	Controllers must maintain written records of their processing activities, which presupposes an inventory of the software systems and components that perform the processing (LPDP Art. 47, mirroring GDPR Art. 30)	Scan
`RS-LPDP-45` Processor and Third-Party Guarantees	Processing may be entrusted only to processors providing sufficient guarantees of appropriate safeguards, requiring knowledge of who supplies each software component in the processing chain (LPDP Art. 45, mirroring GDPR Art. 28)	Scan
`RS-LPDP-52` Breach Notification Readiness	Personal data breaches must be notified to the Commissioner within 72 hours, which requires the ability to identify precisely which software components were affected (LPDP Art. 52, mirroring GDPR Art. 33)	Scan
`RS-LPDP-42` Data Protection by Design	Safeguards reflecting the state of the art must be built into processing systems from the design stage, which requires knowing the exact versions of the components in use (LPDP Art. 42, mirroring GDPR Art. 25)	Scan

All 22 from the standard set, adapted to RS LPDP.