Slovakia

Regulator And AuthorityGreen

The ÚOOÚ SR is Slovakia's sole GDPR supervisory authority and EDPB member, with statutory investigative and corrective powers under GDPR Ch. VI-VIII as transposed via Act 18/2018.

Claims (1):

• The Úrad na ochranu osobných údajov Slovenskej republiky is Slovakia's independent supervisory authority for data protection and is Slovakia's representative on the European Data Protection Board.

Act And InstrumentsGreen

GDPR is the primary directly-applicable instrument; Act No. 18/2018 Coll. is the national supplementing/implementing statute, including provisions on DPIA (Sections 42-43) and ÚOOÚ procedure.

Claims (2):

• Regulation (EU) 2016/679 (GDPR) applies directly in Slovakia as the primary legal instrument governing personal data processing.
• Act No. 18/2018 Coll. on Protection of Personal Data and on Amendments to Certain Acts is Slovakia's national implementing statute supplementing the GDPR, including DPIA rules in Sections 42-43.

Material ScopeGreen

Material scope follows GDPR Art. 2 — covers automated and structured manual processing across private-sector and most public-sector activity.

Claims (1):

• GDPR's material scope in Slovakia covers processing of personal data by the private sector and most of the public sector, whether automated or structured manual processing.

Territorial ScopeGreen

Territorial scope follows GDPR Art. 3, including extraterritorial reach to non-EU controllers offering goods/services to, or monitoring, individuals in Slovakia/the EU.

Claims (1):

• GDPR applies to non-EU-established controllers/processors that offer goods or services to, or monitor the behaviour of, individuals in Slovakia/the EU, requiring an EU representative in certain circumstances.

Regulator Registration And FilingAmber

GDPR removed general notification-to-regulator duties; residual filing obligations in Slovakia are narrower, chiefly DPO-contact notification to ÚOOÚ SR.

Claims (1):

• Controllers/processors appointing a DPO in Slovakia are expected to notify DPO contact details to the ÚOOÚ SR via its notification channel, though GDPR abolished general processing-notification duties.

Lawful BasesGreen

The six GDPR Art. 6 lawful bases (consent, contract, legal obligation, vital interests, public interest/official authority, legitimate interests) apply directly in Slovakia; the legitimate-interest basis does not extend to public-authority processing carried out in performance of their tasks.

Claims (1):

• Processing of personal data in Slovakia is lawful only where at least one of the GDPR Art. 6(1) conditions is satisfied, and the legitimate-interest basis does not apply to processing carried out by public authorities in the performance of their tasks.

Consent ThresholdsGreen

GDPR consent standards (freely given, specific, informed, unambiguous, revocable, distinguishable from other matters) apply directly.

Claims (2):

• Where processing is based on consent, the controller must be able to demonstrate that the data subject gave consent, and consent embedded in a broader written declaration must be clearly distinguishable, intelligible and easily accessible.
• Data subjects in Slovakia have the right to withdraw consent at any time, with withdrawal being as easy as giving consent and not affecting the lawfulness of prior processing.

Special CategoriesAmber

Special-category data (health, biometric, genetic, ethnic origin, political opinion, sexual orientation, criminal data) are subject to the heightened Art. 9 regime; no Slovakia-specific broadening located in research.

Pseudonymisation And AnonymisationGreen

GDPR's pseudonymisation safe-harbour concept applies directly; pseudonymised data remain personal data.

Claims (1):

• GDPR promotes pseudonymisation as a risk-mitigation technique, replacing identifying fields with artificial identifiers, but pseudonymised data remain personal data subject to GDPR.

Access RightGreen

Data subjects may obtain confirmation of processing and access to their personal data and processing metadata under GDPR Art. 15.

Claims (1):

• Data subjects in Slovakia have the right to obtain confirmation from the controller as to whether their personal data are being processed and, if so, to access such data and related processing details.

Rectification And ErasureGreen

Rectification (Art. 16) and erasure/'right to be forgotten' (Art. 17) apply, including onward-notification duties to other controllers when data was made public.

Claims (1):

• Where a controller has made personal data public and is obliged to erase it, the controller must take reasonable steps, including technical measures, to inform other controllers processing the data that the data subject has requested erasure of links, copies or replications.

Restriction And ObjectionGreen

Restriction (Art. 18) and objection, including objection to processing for scientific/historical/statistical research absent overriding public-interest necessity (Art. 21(6)), apply directly.

Claims (1):

• A data subject may obtain restriction of processing in specified circumstances, and, where processing is for scientific, historical research or statistical purposes, may object on grounds relating to their particular situation unless processing is necessary for a public-interest task.

Data PortabilityGreen

The Art. 20 portability right facilitates transfer of personal data between service providers where processing is consent- or contract-based and automated.

Claims (1):

• GDPR's data-portability right facilitates the transfer of personal data between service providers for consent- or contract-based, automated processing.

Deadlines And Response WindowsAmber

GDPR's standard one-month response window (extendable by two further months for complex/numerous requests) applies; no Slovak-specific shortening identified.

Accountability And DpiaGreen

Accountability principle (Art. 5(2)/24) and DPIA triggers (Art. 35) apply directly, with Slovak procedural detail in Act 18/2018 §§42-43.

Claims (2):

• Controllers in Slovakia are responsible for, and must demonstrate, compliance with GDPR's data-protection principles under the accountability principle.
• Where a type of processing, especially using new technologies, is likely to result in high risk to individuals' rights and freedoms, the controller must carry out a DPIA before processing, with Slovak procedural mechanics specified in Act No. 18/2018 Coll. Sections 42-43.

Dpo RequirementsGreen

GDPR Art. 37 DPO-appointment thresholds (public authorities; large-scale regular/systematic monitoring; large-scale special-category/criminal-data processing) apply; Slovak Act 18/2018 supplies notification procedure to ÚOOÚ SR.

Claims (1):

• Controllers and processors in Slovakia must designate a DPO where required by GDPR Art. 37 (public authority status, large-scale systematic monitoring, or large-scale special-category/criminal-data processing).

Ropa RequirementsGreen

Records-of-processing obligations under Art. 30 apply, with an SME exemption unless processing is regular, risk-bearing, or involves special categories/criminal data.

Claims (1):

• GDPR Art. 30 records-of-processing obligations apply in Slovakia; SMEs are exempt unless processing is regular, likely to result in risk to data subjects, or involves special-category or criminal-conviction data.

Joint Controller ArrangementsGreen

Art. 26 joint-controller and Art. 28 processor-contract rules apply directly; processor sub-engagement requires controller authorisation.

Claims (1):

• A processor in Slovakia may not engage a sub-processor without the controller's prior specific or general written authorisation, and processing must be governed by a binding contract or legal act specifying subject-matter, duration, nature and purpose of processing.

Security MeasuresGreen

Art. 32 security-of-processing obligations (pseudonymisation, encryption, resilience, testing) apply directly with no Slovak derogation identified.

Breach NotificationGreen

Breach notification to the regulator within 72 hours of awareness (where risk exists), and to data subjects without undue delay for high-risk breaches, applies directly.

Claims (1):

• Controllers must notify the ÚOOÚ SR of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Retention And DisposalAmber

Storage-limitation principle (Art. 5(1)(e)) applies; no Slovakia-specific statutory retention schedule for general personal data was located beyond sector-specific archival laws.

Transfer MechanismsGreen

GDPR Ch. V mechanisms (adequacy, SCCs, BCRs, codes of conduct/certification, Art. 49 derogations) apply uniformly in Slovakia as in all EU Member States.

Claims (1):

• Slovak controllers and processors may transfer personal data to third countries using European Commission adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, approved codes of conduct/certification, or Art. 49 derogations, per the uniformly-applicable GDPR Chapter V regime.

Adequacy ReceivedGreen

Slovakia does not independently receive adequacy findings; as an EU Member State it benefits from reciprocal EU adequacy arrangements (e.g., with the UK) negotiated at Union level.

Adequacy GrantedGreen

Adequacy decisions covering transfers from Slovakia to third countries are issued exclusively by the European Commission and apply EU-wide; Slovakia has no independent national adequacy-granting power.

Claims (1):

• Adequacy decisions determining whether third countries provide an adequate level of data protection for transfers originating in Slovakia are adopted exclusively by the European Commission under GDPR Art. 45 and apply uniformly across all EU Member States.

Sccs And BcrsGreen

Standard Contractual Clauses and Binding Corporate Rules approved under the EU consistency mechanism are directly usable by Slovak controllers/processors.

Transfer Impact AssessmentAmber

TIA expectations (post-Schrems II) apply per EDPB guidance uniformly; no Slovakia-specific TIA guidance located.

Absence provenance: unavailable. Searched: Ú, O, O, Ú, , S, R, , t, r, a, n, s, f, e, r, , i, m, p, a, c, t, , a, s, s, e, s, s, m, e, n, t, , g, u, i, d, a, n, c, e, , S, c, h, r, e, m, s, , I, I.

Data LocalisationAmber

No general personal-data localisation mandate for Slovakia was identified in research beyond standard EU public-sector/national-security carve-outs.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , d, a, t, a, , l, o, c, a, l, i, s, a, t, i, o, n, , r, e, q, u, i, r, e, m, e, n, t, , p, e, r, s, o, n, a, l, , d, a, t, a, , 2, 0, 2, 5, , 2, 0, 2, 6.

Financial Sector OverlayRed

No Slovakia-specific banking-secrecy/GDPR interaction guidance was located in this pass.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , b, a, n, k, i, n, g, , s, e, c, r, e, c, y, , G, D, P, R, , f, i, n, a, n, c, i, a, l, , s, e, c, t, o, r, , p, e, r, s, o, n, a, l, , d, a, t, a, , o, v, e, r, l, a, y.

Health Sector OverlayRed

No Slovakia-specific health-data overlay statute (e.g., health records act interaction with GDPR) was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , h, e, a, l, t, h, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , a, c, t, , G, D, P, R, , o, v, e, r, l, a, y.

Telecoms And EprivacyAmber

The EU ePrivacy Directive 2002/58/EC applies as the baseline electronic-communications privacy instrument across the EU including Slovakia, pending the still-unadopted ePrivacy Regulation.

Claims (1):

• Directive 2002/58/EC (ePrivacy Directive) governs processing of personal data and privacy in the electronic-communications sector across the EU, including Slovakia, pending the proposed ePrivacy Regulation.

Employment DataRed

No Slovakia-specific employment-data code was independently retrieved in this pass.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , L, a, b, o, u, r, , C, o, d, e, , e, m, p, l, o, y, e, e, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , G, D, P, R.

Credit And ScoringRed

No Slovakia-specific credit-scoring statute was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , c, r, e, d, i, t, , s, c, o, r, i, n, g, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , r, e, g, u, l, a, t, i, o, n.

EducationRed

No Slovakia-specific education-sector data rule was independently retrieved beyond general GDPR applicability.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , e, d, u, c, a, t, i, o, n, , s, e, c, t, o, r, , s, t, u, d, e, n, t, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , G, D, P, R.

InsuranceRed

No Slovakia-specific insurance-sector data rule was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , i, n, s, u, r, a, n, c, e, , s, e, c, t, o, r, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , G, D, P, R, , o, v, e, r, l, a, y.

Cookies And TrackersAmber

Cookie/tracker placement requires prior informed consent under the ePrivacy Directive's transposition, layered with GDPR consent standards where personal data are processed.

Claims (1):

• Placement of cookies or similar trackers on end-user devices in Slovakia requires prior informed consent under the EU ePrivacy Directive framework, layered with GDPR consent standards where personal data are processed.

Dark PatternsRed

No Slovakia-specific dark-pattern prohibition statute was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , d, a, r, k, , p, a, t, t, e, r, n, s, , c, o, n, s, e, n, t, , G, D, P, R, , Ú, O, O, Ú, , g, u, i, d, a, n, c, e.

Opt Out SignalsRed

No Slovakia-specific Global Privacy Control or DAA-equivalent opt-out-signal recognition was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , G, l, o, b, a, l, , P, r, i, v, a, c, y, , C, o, n, t, r, o, l, , r, e, c, o, g, n, i, t, i, o, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n.

Clean Rooms And DcrRed

No Slovakia-specific clean-room/data-collaboration-room guidance was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , d, a, t, a, , c, l, e, a, n, , r, o, o, m, , G, D, P, R, , g, u, i, d, a, n, c, e.

Cross Context AdvertisingAmber

No CPRA-style 'sale'/'share' concept exists in Slovakia; cross-context advertising is governed generically by GDPR consent/legitimate-interest analysis.

Direct MarketingAmber

Direct marketing requires a lawful basis (typically consent or legitimate interest with opt-out) under GDPR; no Slovakia-specific suppression-list mechanism was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , d, i, r, e, c, t, , m, a, r, k, e, t, i, n, g, , c, o, n, s, e, n, t, , s, u, p, p, r, e, s, s, i, o, n, , l, i, s, t, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n.

Profiling RestrictionsGreen

Art. 22 restricts solely-automated decisions with legal or similarly significant effects, subject to enumerated exceptions and safeguards.

Claims (1):

• Data subjects in Slovakia have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, subject to enumerated exceptions and safeguards including human intervention.

Automated Decision Making TransparencyGreen

Controllers must provide meaningful information about the logic involved in automated decision-making under Arts. 13-15, alongside Art. 22 safeguards.

Ai Risk AssessmentsAmber

The EU AI Act layers risk-based obligations (including interaction with GDPR DPIAs) atop GDPR for high-risk AI systems; Slovak national AI Act implementation/competent-authority detail was not independently confirmed in this pass.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , A, I, , A, c, t, , n, a, t, i, o, n, a, l, , c, o, m, p, e, t, e, n, t, , a, u, t, h, o, r, i, t, y, , d, e, s, i, g, n, a, t, i, o, n, , 2, 0, 2, 5, , 2, 0, 2, 6.

Biometric RegimeGreen

Biometric data used for unique identification purposes is a GDPR Art. 9 special category, requiring an Art. 9(2) condition for lawful processing.

Claims (1):

• Biometric data processed for the purpose of uniquely identifying a natural person is treated as a special category of personal data in Slovakia under GDPR Art. 9, requiring a specific lawful condition beyond Art. 6.

Genetic DataGreen

Genetic data is likewise a GDPR Art. 9 special category subject to heightened protection.

State Surveillance CarveoutsAmber

No Slovakia-specific state-surveillance/national-security carve-out statute was independently retrieved in this pass; GDPR Art. 23 permits Member State restrictions for national security, defence and public security subject to necessity/proportionality.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , n, a, t, i, o, n, a, l, , s, e, c, u, r, i, t, y, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , c, a, r, v, e, -, o, u, t, , G, D, P, R, , A, r, t, i, c, l, e, , 2, 3.

Age VerificationAmber

The default GDPR digital-consent age is 16, absent a national derogation (permitted down to a floor of 13); Slovakia's specific national figure was not independently confirmed.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , G, D, P, R, , A, r, t, i, c, l, e, , 8, , a, g, e, , o, f, , c, o, n, s, e, n, t, , c, h, i, l, d, r, e, n, , d, e, r, o, g, a, t, i, o, n.

Claims (1):

• In Slovakia, where an information-society service is offered directly to a child under the applicable digital age of consent (16 by GDPR default, absent a confirmed national derogation not below 13), processing of the child's personal data is lawful only where consent is given or authorised by the holder of parental responsibility.

Parental ConsentGreen

Below the applicable digital-consent age, processing of a child's data for information-society-service offers is lawful only where consent is given or authorised by the holder of parental responsibility.

Claims (1):

• In Slovakia, where an information-society service is offered directly to a child under the applicable digital age of consent (16 by GDPR default, absent a confirmed national derogation not below 13), processing of the child's personal data is lawful only where consent is given or authorised by the holder of parental responsibility.

Minor Profiling BansRed

No Slovakia-specific statutory ban on profiling of minors beyond GDPR's general Art. 22/recital 71 caution was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , m, i, n, o, r, , p, r, o, f, i, l, i, n, g, , b, a, n, , c, h, i, l, d, r, e, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n.

Education SettingsRed

No Slovakia-specific education-sector children's-data statute was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , s, c, h, o, o, l, , s, t, u, d, e, n, t, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , s, t, a, t, u, t, e.

Dependent AdultsRed

No Slovakia-specific dependent-adults data-protection statute beyond general capacity/guardianship civil law was independently retrieved.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , d, e, p, e, n, d, e, n, t, , a, d, u, l, t, s, , i, n, c, a, p, a, c, i, t, a, t, e, d, , p, e, r, s, o, n, s, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n.

Regulator Powers And PenaltiesGreen

ÚOOÚ SR holds GDPR Art. 58 investigative/corrective powers and may impose administrative fines up to the higher of €20 million or 4% of global annual turnover under Art. 83, calculated per EDPB fine-calculation guidelines.

Claims (1):

• The ÚOOÚ SR may impose administrative fines calculated in accordance with EDPB harmonisation guidelines, which require that fines be effective, proportionate and dissuasive in each individual case, up to the maximum GDPR Art. 83 ceilings.

Enforcement Activity IndexRed

No specific ÚOOÚ SR fine/decision data from the past 12 months was independently retrieved in this research pass.

Absence provenance: unavailable. Searched: Ú, r, a, d, , n, a, , o, c, h, r, a, n, u, , o, s, o, b, n, ý, c, h, , ú, d, a, j, o, v, , S, R, , p, o, k, u, t, a, , 2, 0, 2, 5, , 2, 0, 2, 6, ;, , S, l, o, v, a, k, i, a, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , a, u, t, h, o, r, i, t, y, , f, i, n, e, , d, e, c, i, s, i, o, n.

Regulator Funding And CapacityRed

No specific ÚOOÚ SR budget/headcount figures were independently retrieved in this research pass.

Absence provenance: unavailable. Searched: Ú, O, O, Ú, , S, R, , r, o, z, p, o, č, e, t, , z, a, m, e, s, t, n, a, n, c, i, , k, a, p, a, c, i, t, a.

Collective Redress And Class ActionsAmber

EU-level collective-redress mechanisms (Representative Actions Directive) apply as the baseline; Slovakia-specific transposition detail was not independently confirmed.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , R, e, p, r, e, s, e, n, t, a, t, i, v, e, , A, c, t, i, o, n, s, , D, i, r, e, c, t, i, v, e, , t, r, a, n, s, p, o, s, i, t, i, o, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , c, o, l, l, e, c, t, i, v, e, , r, e, d, r, e, s, s.

Private Right Of ActionGreen

GDPR Arts. 79 and 82 grant data subjects a direct judicial remedy and compensation right against controllers/processors, applicable in Slovak courts.

Claims (1):

• Data subjects in Slovakia have a direct right under GDPR Arts. 79 and 82 to an effective judicial remedy and to compensation for material or non-material damage resulting from GDPR infringement, enforceable before Slovak courts.

Recent Developments 180DAmber

The most significant recent Slovak privacy-adjacent development located in research is the Constitutional Court's ruling striking down a mandatory NGO-donor-disclosure amendment as disproportionate to privacy rights; exact ruling date and 180-day currency relative to the 2026-08-05 run date were not independently pinned down.

Absence provenance: unavailable. Searched: S, l, o, v, a, k, i, a, , C, o, n, s, t, i, t, u, t, i, o, n, a, l, , C, o, u, r, t, , N, G, O, , d, o, n, o, r, , d, i, s, c, l, o, s, u, r, e, , r, u, l, i, n, g, , d, a, t, e, ;, , S, l, o, v, a, k, i, a, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , n, e, w, s, , 2, 0, 2, 6.

Claims (1):

• The Constitutional Court of the Slovak Republic struck down a legislative amendment requiring NGOs to publish identifying data of individual donors contributing over €5,000 per year, holding the blanket disclosure obligation disproportionate to privacy and data-protection rights.