---

A national PROTECT survey in Serbia shows that young people understand that digital privacy matters, but many still lack the practical knowledge and confidence to protect their personal data in everyday situations. The findings have directly shaped the PROTECT Toolkit, turning it into a practical resource built around the real needs of young people and youth organisations.

As youth work becomes more digital, personal data is present almost everywhere. Young people fill in registration forms, join WhatsApp groups, share photographs, use social media, provide information about their health or dietary needs, and communicate with organisations before, during, and after youth activities. But how well do they understand what happens to this information?

To explore this question, the Serbian partner Navissos carried out a national needs-analysis survey as part of the PROTECT project. Data collection started on 14 January 2026 and was completed by 20 January 2026. The online survey was first introduced to Navissos members and volunteers and was then shared through direct communication, social media groups, and ongoing youth activities.

In total, 107 people from Serbia completed the survey. Most were young people aged 15 to 30. Around 55% were aged 20–25 and more than one third were aged 15–19. The sample included students, participants in youth activities, volunteers in youth organisations, and people with different levels of experience in the youth sector. While the survey is not statistically representative of all young people in Serbia, it gives a valuable picture of current habits, concerns, and knowledge gaps among digitally active young people.

Privacy matters to young people, but good habits are not always there

One of the clearest findings is that young people are very active online. Almost 60% of respondents said that they use social media several times every day, while another 26% use it daily.

At the same time, privacy settings are not checked regularly. Only around one in four respondents said that they review their privacy settings regularly. Most do it only occasionally or rarely, while some never check them at all.

This creates an important gap. Young people spend a large part of their everyday lives online, but the settings that control who can access their information are often left unchanged.

Respondents generally felt that they understood what personal data means, but their answers showed less confidence when questions became more practical. When asked what they would do if their personal data were misused, only 38% said that they knew what steps to take. More than 40% answered “maybe”, while around one in five said they did not know.

The survey also showed relatively low trust in social media platforms. On a five-point scale, respondents gave an average score of only 2.36 when asked whether they trusted social media platforms to protect their data responsibly.

Privacy notices were another weak point. Respondents were much more likely to skim or ignore privacy information than to read it carefully. This is important because clicking “I agree” does not necessarily mean that a person has understood what they have accepted.

In fact, 83% of respondents said that they had signed a consent form without fully understanding it.

Another important finding concerned the relationship between young people and organisations collecting their data.

The survey revealed strong uncertainty about whether a participant can refuse to provide information without risking their place in an activity. Almost 88% were unsure whether they could safely say no to sharing certain information.

This feeling was also visible in another result. Almost three quarters of respondents said that there had been situations where they wanted to refuse to provide information but felt that they had to give it anyway.

Participants also expressed uncertainty about why organisations ask for particular information. When asked whether the purpose of data collection had been clearly explained, the large majority selected “not very clearly”.

These results point to an important lesson for youth organisations. Privacy is not protected simply by adding a consent box at the bottom of a form. Young people need to understand what is being collected, why it is needed, whether it is required or optional, who will see it, and what happens if they say no.

From survey findings to practical tools

Rather than building the Toolkit around legal theory alone, the PROTECT team focused on the situations that youth workers and young people actually face.

The final Toolkit explains GDPR concepts in simple language and connects them with registration forms, youth exchanges, workshops, photographs, social media, shared drives, newsletters, partner communication, and project reporting. It follows five practical ideas throughout: explain before you collect, collect less, separate different purposes, control access, and delete data when it is no longer needed.

Many of the tools requested through the Serbian survey can now be found directly in the Toolkit. It includes a participant privacy notice, a data-minimised registration form blueprint, separate photo and video permission templates for adults and minors, guidance for sensitive support information, a partner data-sharing note, storage and access checklists, a retention schedule, and practical tools for responding to privacy incidents.

The Toolkit also includes realistic scenarios. Youth workers can explore questions such as what happens when a full participant list is shared with every project partner, when health information is posted in a WhatsApp group, when somebody wants to withdraw permission for a photograph, or when project files remain accessible long after an activity ends.

The survey also showed that privacy education cannot focus only on organisations. Young people need simple ways to protect themselves too. For this reason, the Toolkit includes a dedicated youth-facing section covering privacy settings, location sharing, passwords, two-factor authentication, online oversharing, personal data rights, and what to do if something goes wrong. A trainer’s guide helps youth workers turn these topics into interactive sessions rather than formal GDPR lectures.

A simple message from the Serbian results

The research in Serbia showed something encouraging. Young people already care about privacy. What is missing is often the practical bridge between knowing that privacy matters and knowing what to do about it.

That is exactly the gap PROTECT aims to address.

For a young person, better privacy can start with something as simple as checking an app permission, asking why a form needs certain information, or knowing that optional consent can be refused.

For a youth organisation, it can start with removing one unnecessary question from a registration form, explaining the purpose of data collection more clearly, restricting access to sensitive information, or deleting files that no longer need to be stored.