Private investigation in Serbia is a product of relatively recent legislation. First Law on PI was adopted in 2013, and the last amendments were enacted just three years ago (2018).
Private investigations in 
the Republic of Serbia are classified as administrative services, subclassified as investigative services. Those services include investigative and detective services and activities of all private investigators regardless of who or what they investigate (detective work). Investigative and detective services refer to the collection, data processing, and transferring of information by this Law and other regulations by legal entities and entrepreneurs licensed to conduct detective activities as handlers and employees of detective agencies as data processors.
Only a legal entity licensed to conduct detective activities can provide private investigation in the Republic of Serbia. The license is issued by the relevant Police Department of the Ministry of Interior.
Data Processing
A detective may process data on:
1) missing persons and/or persons in hiding to avoid criminal, misdemeanor, or other prosecution,
2) persons who have caused damage to the service user, if liability for the damage is determined,
3) persons who anonymously and unlawfully treat the service user, with or without causing harmful consequences,
4) Lost or stolen goods,
5) Business intelligence,
6) Intellectual and industrial property protection,
7) Employment screening,
8) Civil lawsuits and perpetrators of these offenses,
9) Violation of labor duties and work discipline.
The manner data is collected during the provision of detective activities, i.e., detective work must be in accordance with the Law on detective activity and other applicable regulations on personal data protection. The data may only be collected for the purpose stated in the Agreement.
When performing detective work, the detective documents the data: in the form of a record, note, written report, statement, polygraph report, and photography.
The client receives collected information in the form of a written report. A copy of the report must be kept for at least five years.
Detective services may only be provided based on and within the scope of the Agreement (contract) between a service provider (detective) and service user (client).
A client must sign a Special Power of Attorney (POA) prepared by the service provider to execute contracted services.
The contract, among other elements, must include:
1) clearly determined purpose of data processing with explanation,
2) data collection sources,
3) manner the date will be handled,
4) data classification; open, secret, confidential, etc.
5) time of data storage,
6) data protection measures.
A detective is obliged to reject the conclusion of the service contract if the request of the service user relates to activities that are not within the detective’s jurisdiction, or when requested to process protected data, or when the conduct of such services is contrary to the interests of other service users with whom the contract is already concluded, and when service requested is against other laws and public moral.
How can data be collected and processed?
A detective can collect and process data on other persons in accordance with regulations governing personal data protection and free access to information of public importance.
The detective is obliged to show the detective identification card and POA to the person the data is collected from at their request.
Processing without consent is permitted only if the processing is done in line with regulations governing personal data protection.
Collected data can only be used for the purpose stated in the Agreement and can not be shared with third parties or publicly disclosed unless otherwise regulated.
All data collected during the course of a private investigation is classified as secret and must be treated as such by a private investigator.
