Data can be transferred from the Republic of Serbia to a state party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

Data may be transferred from the Republic of Serbia to a state that is not a party to the Convention or an international organization if such state or international organization has a regulation or a data transfer agreement in force which provides a level of data protection equivalent to that envisaged by the Convention.

In cases of transborder transfer of data to a state or organization which is not a party to the Convention, the Commissioner shall determine whether the requirements are met and safeguards put in place for the transfer of data from the Republic of Serbia and shall authorize such transfer.