Monitoring Employee Emails in Serbia: Employer Rights, Legal Limits & Privacy Rules

Monitoring employee emails in Serbia and the related employer rights sit at the intersection of three legal disciplines, employment law, data protection and fundamental privacy rights, and getting the balance wrong exposes a company to regulatory fines, civil liability and even criminal risk. Employers in Serbia have legitimate reasons to supervise work communications: protecting confidential information, safeguarding intellectual property, ensuring business continuity and investigating misconduct. Yet those interests must be weighed against an employee’s right to private life, which is protected both under domestic legislation and under the European Convention on Human Rights. This guide explains when and how Serbian employers may lawfully monitor work emails, what documentation and policies they need, and how to minimise enforcement and litigation exposure.

It is written for employers, HR teams, in-house counsel, compliance officers and foreign investors operating or planning to operate in Serbia.

Introduction: scope and why this matters

Workplace surveillance has become routine in the modern enterprise, but the law has not stood still. Serbia’s data protection framework imposes strict conditions of lawfulness, transparency and proportionality on any processing of personal data, and an employee’s email, including its metadata, is personal data. At the same time, the European Convention on Human Rights protects correspondence under Article 8, and the European Court of Human Rights has developed a detailed test that national courts and regulators look to when assessing employer monitoring. Understanding monitoring employee emails in Serbia and employer rights means understanding how these instruments interact.

The practical message for employers is clear: monitoring is permissible, but only within defined limits, supported by a documented legal basis, clear policies and genuine safeguards.

1. Legal framework governing email monitoring in Serbia

There is no single statute that answers every question about workplace email surveillance. Instead, the rules governing monitoring employee emails in Serbia and employer rights emerge from the interplay of the data protection statute, the Labour Law, criminal provisions on the confidentiality of communications and the overarching human-rights standard set by the ECHR. Employers must read these sources together rather than in isolation.

Serbia’s Law on Personal Data Protection, core duties

The Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti) is the primary statute. It applies to any processing of personal data, and the content and metadata of employee emails plainly fall within its scope. The law, which is closely aligned with the EU General Data Protection Regulation, requires that processing be lawful, fair and transparent; that data be collected for specified, explicit and legitimate purposes; that it be adequate, relevant and limited to what is necessary (the principle of data minimisation); and that it be retained no longer than necessary. Controllers, here, the employer, must be able to demonstrate compliance with each of these principles.

Any email-monitoring programme must therefore rest on an identified lawful basis, be documented, and be capable of withstanding scrutiny by the supervisory authority.

Labour Law obligations and employment contract limits

The Labour Law (Zakon o radu) complements the data protection regime. It protects the dignity of the employee and constrains the ways in which an employer may interfere with the working relationship. Measures that affect an employee’s privacy or dignity typically require a clear basis, whether in the employment contract, an internal act such as a rulebook, or statute, and must be applied consistently and without abuse. Disciplinary action based on evidence gathered through monitoring will be vulnerable to challenge if the monitoring itself was unlawful or if the employee was never informed that their communications could be inspected. In practice, the employment contract and internal policies are the vehicles through which an employer establishes and communicates its monitoring rules.

Other applicable laws, criminal interception and telecommunications

Beyond data protection and labour rules, Serbian criminal law protects the confidentiality of correspondence and communications. Intercepting or accessing communications without a lawful basis can engage criminal liability for unauthorised interception or breach of the secrecy of correspondence under the Criminal Code of the Republic of Serbia. This is a critical distinction: a monitoring measure that might be defensible as a data-processing operation can nonetheless cross into criminal territory if it amounts to covert interception of private communications. Employers should treat the criminal dimension as a hard outer limit, one that is particularly relevant where an employer contemplates reading the content of messages or accessing accounts that have a private character.

ECHR and Bărbulescu, the proportionality test

The single most influential authority on monitoring employee emails in Serbia is not a Serbian statute at all, but a judgment of the European Court of Human Rights. In Bărbulescu v. Romania (no. 61496/08), the Grand Chamber held that an employee’s communications in the workplace are covered by the notions of “private life” and “correspondence” under Article 8, and that monitoring of those communications must be accompanied by adequate safeguards.

The Court set out factors that national authorities should weigh when assessing whether monitoring was proportionate: whether the employee was notified in advance of the possibility and nature of monitoring; the extent of the monitoring and the degree of intrusion into privacy; whether the employer provided legitimate reasons to justify the monitoring; whether a less intrusive method was available; the consequences of the monitoring for the employee; and whether appropriate safeguards were in place. Serbian courts and the data protection authority apply this proportionality analysis by analogy, which is why the Bărbulescu criteria function in practice as a checklist for any email-monitoring programme.

2. When is monitoring permissible? Lawful bases and limits

The question employers most often ask, can we read our employees’ work email?, has a conditional answer. Monitoring is permissible where the employer has a valid lawful basis, where the measure is necessary and proportionate to a legitimate aim, and where employees have been informed in a transparent way. Each element must be present; none is sufficient on its own.

Legitimate interest and necessity

Legitimate interest is usually the most robust basis for routine email monitoring. An employer may rely on its genuine interest in protecting network security, preventing data leakage, safeguarding trade secrets and ensuring business continuity. However, legitimate interest is not a blank cheque. The employer must carry out a balancing exercise, documenting the interest pursued, the necessity of the monitoring to achieve it, and the impact on the employee’s rights and freedoms. Where the same objective can be achieved by a less intrusive means, for example, by reviewing aggregated traffic logs rather than reading message content, legitimate interest will not justify the more intrusive option. Necessity, in other words, is assessed against the least intrusive effective measure.

Consent, when is it valid?

Consent is frequently proposed as a basis for workplace monitoring, but it is the weakest option in the employment context. The reason is the imbalance of power between employer and employee: consent must be freely given, and a worker who fears adverse consequences for refusing can rarely give consent that is genuinely free. For this reason, regulators generally caution against relying on consent as the primary basis for employee monitoring. It may play a supporting role in specific, discrete situations, but employers should not design a monitoring programme around consent to employee monitoring in Serbia as its foundation. Legitimate interest, combined with transparency and proportionality, is the more defensible route.

Exceptional circumstances, security incidents, IP theft and misconduct

More intrusive monitoring, including the targeted review of message content, may be justified in exceptional circumstances. A credible suspicion of data exfiltration, theft of intellectual property, serious misconduct or an active security incident can support a narrowly scoped, time-limited examination of specific communications. The key is that the response must be proportionate to the specific threat: the employer should define what it is looking for, limit the scope of access to what is strictly necessary, document the suspicion and the decision-making, and avoid a general trawl through unrelated correspondence. An escalating, incident-driven approach is far more defensible than continuous content monitoring of the entire workforce.

Proportionality and the least intrusive means

Proportionality is the thread running through every lawful monitoring decision. The Bărbulescu factors translate directly into practice: start with the least intrusive technique capable of achieving the aim; escalate only where a lower-impact measure proves inadequate; inform employees in advance; and keep a record of the reasoning. An employer that can show it chose metadata review over content reading, or targeted investigation over blanket surveillance, will be far better placed before the Commissioner or a court than one that monitored everything “just in case.”

3. Practical compliance steps for employers

Translating the legal framework into operational reality requires documentation, communication and governance. The following steps form the backbone of a defensible approach to monitoring employee emails in Serbia.

Drafting an email and IT monitoring policy, mandatory elements

A written email and IT monitoring policy is the foundation of lawful surveillance. It serves two functions at once: it provides transparency to employees and it evidences the employer’s legal basis and safeguards. A robust policy should address, at minimum:

• Purpose and scope. The legitimate aims pursued (security, IP protection, compliance, business continuity) and which systems and accounts the policy covers.
• Legal basis. A clear statement of the lawful basis relied upon, typically legitimate interest, with reference to the Law on Personal Data Protection.
• Nature and extent of monitoring. What is monitored, metadata, content, automated filtering, and under what circumstances content may be reviewed.
• Triggers for escalation. The circumstances in which routine logging may escalate to targeted content review, and who authorises that escalation.
• Personal use. Whether limited personal use of work email is permitted, and the consequences for the privacy expectations attaching to such use.
• Data retention. How long monitoring data is kept and when it is deleted.
• Access controls. Who within the organisation may access monitoring data and under what authorisation.
• Employee rights. How employees can exercise their data protection rights, including access and complaint channels.

The policy should be approved at an appropriate level, version-controlled, and distributed so that employees demonstrably receive it. A policy that exists on paper but is never communicated fails the transparency test that Bărbulescu demands.

Notice and transparency mechanisms

Transparency is not a one-off event. Beyond the policy itself, employers should provide clear, accessible notice through onboarding documentation, login banners, intranet notices and periodic reminders. The objective is that no reasonable employee could be surprised to learn that their work communications may be subject to monitoring. Prior notification was decisive in Bărbulescu, and it remains the most frequently decisive factor in disputes about workplace surveillance.

Data minimisation, retention and access controls

Collecting less data, keeping it for less time and restricting who can see it are the practical expressions of the minimisation principle. Employers should capture only the data necessary for the stated purpose, define retention periods that are no longer than needed, and implement technical and organisational access controls so that monitoring data is viewed only by authorised personnel under a documented process. Over-collection and indefinite retention are among the most common failings the supervisory authority encounters.

Conducting DPIAs and risk assessments

Where monitoring is systematic or likely to result in a high risk to employees’ rights, a data protection impact assessment is an essential tool. A DPIA documents the purpose and necessity of the monitoring, the risks to employees, the measures taken to mitigate those risks and the residual risk the employer accepts. It is both a compliance obligation in appropriate cases and a powerful evidential record if the employer’s practices are ever challenged. Even where a formal DPIA is not strictly required, a documented risk assessment is strongly advisable before any new or expanded monitoring is introduced.

Template clauses and model wording

Employment contracts and internal acts should contain clauses that put employees on notice and establish the employer’s authority to monitor within the policy’s limits. Model wording typically confirms that company IT systems and email accounts are provided for business purposes, that their use may be monitored in accordance with the monitoring policy, and that employees should have no absolute expectation of privacy in their use of company systems, while preserving the proportionality and safeguards the law requires. Bespoke drafting is preferable to generic templates, because the clause must align precisely with the actual monitoring practices and the lawful basis relied upon.

4. Monitoring techniques: what employers use and legal risk comparison

Not all monitoring is equal in the eyes of the law. The intrusiveness of the technique drives the legal risk and the level of justification required.

Passive monitoring, logs and metadata

Passive monitoring captures traffic data: sender, recipient, timestamps, message size and attachment presence, without reading the content of messages. Because it does not expose the substance of correspondence, it is lower in privacy impact and generally easier to justify under legitimate interest. It still constitutes processing of personal data and therefore requires a lawful basis, transparency and safeguards, but it sits at the more defensible end of the spectrum.

Content interception, reading messages

Reading the content of messages is the most intrusive form of monitoring and attracts the highest legal risk. It engages Article 8 at its core, requires compelling justification, and risks crossing into criminal interception if carried out without a proper basis. Content review should be reserved for genuine, documented exceptional circumstances, scoped as narrowly as possible, and authorised at a senior level.

Automated monitoring, keywords and filters

Automated tools that scan for keywords, block malicious attachments or flag potential data leakage occupy a middle ground. They can be proportionate where configured to serve a specific security purpose and to surface only relevant matches rather than exposing all communications. The configuration, the human review that follows an automated flag and the transparency provided to employees all determine where a given tool falls on the risk spectrum.

5. Employee accounts: work versus personal emails

One of the sharpest distinctions in the law of monitoring employee emails in Serbia is the line between corporate accounts and personal accounts. The expectation of privacy, and therefore the employer’s room for manoeuvre, differs markedly between the two.

Boundaries for personal accounts accessed from workplace devices

Accessing an employee’s personal email account, a private webmail inbox opened on a work device, for example, carries very high legal risk. A private account retains a strong expectation of privacy regardless of the device used, and reading its contents without a proportionate and documented justification can breach data protection law and engage criminal provisions on the confidentiality of correspondence. Employers should, as a rule, avoid accessing personal mailboxes. Where a genuine and imminent risk exists, or where a court order authorises access, any examination must be scoped to the minimum necessary and conducted with legal advice. The safer course is to confine monitoring to corporate systems and to prohibit, through policy, the use of personal accounts for work purposes.

Bring Your Own Device (BYOD) and cloud accounts

BYOD arrangements blur the boundary between corporate and personal data because the same device holds both. An effective BYOD policy must separate business data from personal data, define what the employer may access and under what conditions, and make clear that the employer will not inspect purely personal content. Cloud-based accounts raise similar issues: synced corporate mailboxes may sit alongside personal cloud storage, and the employer’s right to access does not extend to private material simply because it resides on a managed device. Containerisation, clear policies and a documented basis are the practical tools for managing these grey areas without overreaching.

6. Enforcement, remedies and penalties

Getting monitoring wrong is not a theoretical risk. Serbia has an active supervisory authority, a functioning labour inspection and court system, and criminal provisions that can be triggered by unlawful interception.

Role of the Commissioner for Personal Data Protection

The Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) is the supervisory authority for data protection in Serbia. The Commissioner has the power to investigate complaints, conduct inspections, issue orders and impose or initiate administrative fines for breaches of the Law on Personal Data Protection. Employees who believe their communications have been monitored unlawfully can complain directly to the Commissioner, and the authority’s guidance and decisions set the practical standard against which employer conduct is measured. An employer that cannot produce a documented lawful basis, a monitoring policy, evidence of transparency and a proportionality assessment is exposed to adverse findings and financial penalties.

Labour inspections, courts and remedies

Beyond the data protection authority, unlawful monitoring can surface in employment disputes. Where an employer dismisses or disciplines an employee on the basis of evidence obtained through unlawful surveillance, the measure may be overturned by the courts, and the employee may obtain remedies including reinstatement and compensation. Civil claims for damages arising from the infringement of privacy are also available. Labour inspections can examine whether internal acts and practices comply with the Labour Law’s protection of employee dignity. The practical consequence is that evidence gathered unlawfully may be worthless, or worse, may itself become the basis of a claim against the employer.

Criminal law overlap, illegal interception

The most serious exposure is criminal. Unauthorised interception of communications or breach of the secrecy of correspondence can give rise to criminal liability for the individuals involved, not merely administrative liability for the company. This is why covert content monitoring and unauthorised access to private accounts are so dangerous: they risk converting a compliance failure into a criminal matter. The criminal dimension reinforces the central lesson of monitoring employee emails in Serbia, transparency and proportionality are not optional refinements but the conditions that keep lawful monitoring on the right side of the line.

7. Incident response: suspected leaks or security breaches

When an employer suspects that confidential data has been leaked by email, the temptation is to act quickly and broadly. The law requires the opposite instinct: act decisively but proportionately, and document every step.

Immediate steps if suspecting a data leak

On a credible suspicion, the first priority is to contain the risk and preserve evidence without over-collecting. Define the specific concern, identify the accounts and time periods genuinely relevant to it, and limit access to authorised investigators. Resist the urge to review unrelated correspondence. A narrowly scoped, suspicion-driven response is both more effective and far more defensible than a broad trawl.

Evidence preservation and the legal chain for lawful monitoring

Where monitoring may later support disciplinary action or litigation, the integrity of the evidence matters. Preserve logs and relevant messages in a way that maintains their authenticity, record who accessed what and when, and document the authorisation for each investigative step. A clear chain of handling demonstrates that the monitoring was both lawful and reliable, which is essential if the evidence is ever tested before the Commissioner or a court.

Notification obligations and documentation for investigations

If the incident involves a personal data breach, the employer must assess its notification obligations under the Law on Personal Data Protection, including whether and when to notify the Commissioner and affected individuals. Throughout the investigation, maintain a contemporaneous record of the suspicion, the legal basis for the monitoring steps taken, the scope limits applied and the decisions made. This documentation is the employer’s primary defence if the lawfulness of the response is later questioned.

8. Practical checklist and model policy highlights

The following checklist distils the core compliance actions into a practical sequence employers can implement. It should be read alongside tailored legal advice, but it captures the essential building blocks of lawful monitoring.

1. Identify and document the legitimate aims that justify monitoring.
2. Select a lawful basis, usually legitimate interest, and record the balancing assessment.
3. Draft and approve a written email and IT monitoring policy covering purpose, scope, nature of monitoring and safeguards.
4. Include monitoring clauses in employment contracts and internal acts.
5. Provide clear, advance notice through onboarding, banners and reminders.
6. Default to the least intrusive technique; escalate only on documented triggers.
7. Conduct a DPIA or documented risk assessment before new or expanded monitoring.
8. Apply data minimisation and define retention periods.
9. Implement access controls so only authorised staff view monitoring data.
10. Train HR, IT and managers on lawful monitoring and escalation.
11. Keep records of the legal basis, DPIAs, policy versions, approvals and access logs.
12. Review and audit the monitoring programme periodically and after incidents.

Model policy excerpts should confirm that company systems are provided for business purposes, that use may be monitored in accordance with the policy, that content review is reserved for defined circumstances with senior authorisation, and that employees retain their data protection rights and complaint channels. Employers planning corporate change should also review their wider governance and compliance obligations and align monitoring policies with transaction diligence where relevant to cross-border M&A and transaction structuring in Serbia.

Conclusion

Employer rights to monitor employee emails in Serbia are real but conditional. Serbian employers may lawfully supervise work communications to protect security, intellectual property and business continuity, but only where they have a documented lawful basis, have informed employees in advance, and have chosen the least intrusive means capable of achieving a legitimate aim. The data protection statute, the Labour Law, criminal confidentiality provisions and the ECHR’s proportionality test in Bărbulescu v. Romania together define the limits, and the Commissioner, the courts and the criminal law stand ready to enforce them. Employers who build their programmes on clear policies, transparency, minimisation and careful documentation will be well positioned to monitor lawfully.

Because every organisation’s circumstances differ, employers should seek tailored legal advice before implementing or expanding any monitoring of employee communications in Serbia.

Sources

1. Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)
2. Legal Information System / Official Gazette of the Republic of Serbia (Pravno-informacioni sistem)
3. European Convention on Human Rights (text), Council of Europe
4. European Court of Human Rights, Bărbulescu v. Romania, no. 61496/08 (HUDOC)
5. European Data Protection Board (EDPB)
6. University of Belgrade, Faculty of Law