VPNs with servers in Serbia

Article 129 covers the data needed to trace a communication’s source, destination, timing and type, the user’s terminal and the location of mobile equipment; keeping content is forbidden. Operators must also enable lawful interception (art. 127). The 2023 law defines an operator as a provider of public electronic communications networks or associated facilities and refers elsewhere to a separate interception and retention statute. Whether a VPN operator is covered is not established.

Under article 122 of the Law on Games of Chance (Official Gazette 18/2020, 94/2024), when an inspector of the Administration for Games of Chance finds a foreign person running games of chance by electronic means without its approval, the inspector bans the activity. The competent body then arranges for electronic communications operators to block the IP address and for banks and payment providers to block transactions. An appeal does not suspend the decision.

Article 317 of the Criminal Code punishes whoever provokes or incites ethnic, racial or religious hatred or intolerance among the peoples or ethnic communities living in Serbia with six months to five years’ imprisonment; doing so by coercion, maltreatment, endangering security, derision of national, ethnic or religious symbols, damage to property or desecration of graves or memorials carries one to eight years.

The data that trace a communication to its source and to the user’s terminal equipment (art. 129) are held for twelve months and released on a court decision (art. 128).

In decision IUz-1245/2010, published in Official Gazette 60/13 and effective from 10 July 2013, the Constitutional Court declared article 129(4) of the 2010 law unconstitutional. Article 128 as amended after the decision allows access to retained data only on a court decision, where the original text let a competent state body request them.

Under the surviving text the personal-data protection authority supervises operators’ retention duties (art. 130), and operators and the bodies that access data must each keep an annual record of requests and send it to that authority by 31 January (art. 130a). The order of the rows is the security score, and a server’s location is not a recommendation.