Is a privacy policy required for a website in Serbia - Zephyra Studio

Yes, in practice it is, even though no law spells it out in exactly those words. As soon as a site collects any personal data (an email through a form, a name, an IP address through analytics), the Law on Personal Data Protection imposes a duty to INFORM that, in practice, is fulfilled precisely by a privacy policy. This is NOT legal advice, just a practical explanation, consult a lawyer for your specific situation.

The law does not say "privacy policy", but requires the same thing

The Law on Personal Data Protection does not use the phrase "privacy policy" as a formal document name, but it requires a data controller to inform the person data is collected from: what data is collected, for what purpose, how long it is kept, and whether it is shared with third parties. In practice, the only reasonable way to fulfil this on a website is a published, accessible page with that information, which is exactly what everyone calls a "privacy policy".

In other words, avoiding the word "mandatory" does not change the outcome: a site collecting data with zero publicly available information about it is, in practice, in breach of the duty to inform, whatever that page is formally called.

What actually needs to be in it

A privacy policy must accurately match the actual collection on your site, not be a generic copy from somewhere else. For a typical small site that usually means: which forms collect data (contact, newsletter, calculator), which analytics tool is used (e.g. Google Analytics) and what it collects, which third parties data is shared with (an email provider for sending mail, a hosting provider), how long data is kept, and how someone can request access to or deletion of their data.

A generic, copied privacy policy that mentions tools and practices your site does not actually use is riskier than having none, since it actively states things that are not true about your business, which is worse than a gap.

Who has no excuse to skip it

Any site with ANY form at all (even just a contact form), analytics, or a newsletter sign-up collects personal data and thereby falls under the duty to inform. Even a fully static site with no form at all, if it uses analytics that logs IP addresses, still collects personal data in the legal sense.

The genuine exception: a fully static page with no form, no analytics, and no cookie that identifies a visitor, theoretically collects no personal data, but that is rare today, almost every site runs at least Google Analytics or something similar.

Source

Key takeaways

• No law literally says "a privacy policy is mandatory", but the duty to inform about data collection in practice requires exactly that.
• The policy must match what your site actually collects, not be a generic copy.
• Any form, any analytics tool, and any newsletter sign-up trigger this duty.
• The only genuine exception is a fully static site with no form, analytics, or identifying cookie, rare in practice.
• This is a practical explanation, not legal advice, consult a lawyer for your specific situation.

Conclusion

The question is not whether you NEED a privacy policy, but whether you are willing to risk breaching the duty to inform without one. Our website builds include a privacy policy matched to actual data collection as a standard part of the work, not a generic template.