Slovenia

Regulator And AuthorityGreen

The Information Commissioner is confirmed as Slovenia's GDPR supervisory authority and EDPB member.

Claims (1):

• The Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec) is the national supervisory authority responsible for enforcing GDPR and ZVOP-2 in Slovenia and is a full voting member of the European Data Protection Board.

Act And InstrumentsGreen

ZVOP-2, adopted 15 December 2022, transposes GDPR into Slovenian law.

Claims (1):

• Slovenia's Personal Data Protection Act (ZVOP-2), adopted by the National Assembly on 15 December 2022, transposes the GDPR into Slovenian national law.

Material ScopeGreen

ZVOP-2 covers confidentiality of processing, public-area video surveillance, special categories, biometrics, and research/archival/statistical processing.

Claims (2):

• ZVOP-2 contains specific national provisions on the confidentiality of personal data processing, video surveillance in public areas, and the processing of special categories of personal data.
• ZVOP-2 additionally regulates transmission of personal data in the public and private sectors, biometric data processing, and personal data processing for research, archival, and statistical purposes.

Territorial ScopeGreen

GDPR Article 3 establishment- and targeting-based territorial scope applies directly in Slovenia as EU law.

Claims (1):

• As GDPR applies directly in Slovenia as an EU Member State, GDPR Article 3's establishment-based and targeting-based extraterritorial application rules govern controllers/processors operating in or targeting data subjects in Slovenia.

Regulator Registration And FilingAmber

GDPR's abolition of general prior-notification/registration duties applies; no confirmed Slovenia-specific residual general filing regime was located in this pass beyond narrow sectoral possibilities.

Claims (1):

• GDPR's abolition of general prior notification/registration duties applies in Slovenia; ZVOP-2 does not reinstate a general filing regime, though narrower national filing/registration duties may apply to specific processing operations under national law.

Lawful BasesGreen

GDPR Article 6's six lawful bases apply directly; ZVOP-2 adds public-sector derogations rather than replacing them.

Claims (1):

• The six lawful bases for processing under GDPR Article 6 (consent, contract, legal obligation, vital interests, public task, legitimate interests) apply directly in Slovenia, with ZVOP-2 adding national derogations for certain public-sector processing.

Consent ThresholdsAmber

Slovenia's specific Article 8 age-of-consent derogation figure was not confirmed via available secondary sources in this pass.

Claims (1):

• The precise national age threshold Slovenia has set for a child's own consent to information-society services under the GDPR Article 8 derogation could not be confirmed from available secondary sources in this research pass; the GDPR default of 16 applies absent a confirmed lower national threshold.

Special CategoriesGreen

ZVOP-2 contains dedicated national rules on special categories and biometric data, supplementing GDPR Article 9.

Claims (1):

• ZVOP-2 includes dedicated national rules on the processing of special categories of personal data and on biometric data processing, supplementing the GDPR Article 9 regime.

Pseudonymisation And AnonymisationRed

No Slovenia-specific pseudonymisation/anonymisation safe-harbour provisions were identified in this research pass beyond the GDPR baseline definitions.

Absence provenance: No SI-specific secondary source located distinguishing national pseudonymisation/anonymisation rules from the GDPR Article 4(5)/Recital 26 baseline.. Searched: S, l, o, v, e, n, i, a, , Z, V, O, P, -, 2, , p, s, e, u, d, o, n, y, m, i, s, a, t, i, o, n, , a, n, o, n, y, m, i, s, a, t, i, o, n, , s, a, f, e, , h, a, r, b, o, u, r.

Access RightGreen

GDPR Article 15 access right applies directly; no SI-specific derogation identified.

Claims (1):

• GDPR Articles 13-22 data subject rights, including the right of access under Article 15, apply directly and are enforced by the Slovenian Information Commissioner, supplemented procedurally by ZVOP-2.

Rectification And ErasureGreen

The Slovenian SA is participating in the EDPB's 2025 coordinated enforcement action on the right to erasure.

Claims (1):

• In 2025, the Slovenian Information Commissioner is participating, alongside 29 other DPAs and the EDPS, in the EDPB's Coordinated Enforcement Framework action focused on controllers' implementation of the right to erasure (Article 17 GDPR).

Restriction And ObjectionAmber

GDPR Articles 18/21 apply directly; no SI-specific case identified in this pass.

Absence provenance: No SI-specific enforcement or guidance item located distinct from the GDPR baseline.. Searched: S, l, o, v, e, n, i, a, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , r, e, s, t, r, i, c, t, i, o, n, , o, b, j, e, c, t, i, o, n, , p, r, o, f, i, l, i, n, g, , o, p, t, -, o, u, t, , e, n, f, o, r, c, e, m, e, n, t.

Data PortabilityAmber

GDPR Article 20 portability right applies directly; no SI-specific implementation guidance identified in this pass.

Absence provenance: No SI-specific secondary source located beyond the GDPR baseline text.. Searched: S, l, o, v, e, n, i, a, , d, a, t, a, , p, o, r, t, a, b, i, l, i, t, y, , G, D, P, R, , A, r, t, i, c, l, e, , 2, 0, , g, u, i, d, a, n, c, e.

Deadlines And Response WindowsGreen

The standard one-month (extendable to three-month) response deadline under GDPR Article 12(3) applies to controller responses in Slovenia.

Claims (1):

• The one-month standard response deadline (extendable up to three months for complex requests) under GDPR Article 12(3) applies to controller responses to data subject rights requests in Slovenia.

Accountability And DpiaGreen

The 2025 school case confirms active enforcement of GDPR Article 25 privacy-by-design/default duties.

Claims (1):

• In a 2025 enforcement action, the Slovenian SA reprimanded a school and its principal after finding a failure to implement data protection by design and by default under GDPR Article 25, having granted an external school-meal-service provider unrestricted access to the entire student database, including sensitive subsidy and account-balance data, when only names and surnames were necessary.

Dpo RequirementsAmber

GDPR Articles 37-39 DPO thresholds apply directly; ZVOP-2 does not materially narrow them per available sources.

Claims (1):

• GDPR Articles 37-39 DPO appointment thresholds (public authorities, large-scale systematic monitoring, large-scale special-category processing) apply directly in Slovenia; no confirmed material narrowing or widening by ZVOP-2 was identified in this pass.

Ropa RequirementsAmber

No Slovenia-specific ROPA guidance beyond the GDPR Article 30 baseline was identified in this pass.

Absence provenance: No SI-specific secondary source located beyond general GDPR Article 30 applicability.. Searched: S, l, o, v, e, n, i, a, , R, O, P, A, , r, e, c, o, r, d, s, , o, f, , p, r, o, c, e, s, s, i, n, g, , A, r, t, i, c, l, e, , 3, 0, , g, u, i, d, a, n, c, e, , I, n, f, o, r, m, a, t, i, o, n, , C, o, m, m, i, s, s, i, o, n, e, r.

Joint Controller ArrangementsAmber

No Slovenia-specific joint-controller guidance was identified in this pass beyond the GDPR Article 26 baseline.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , j, o, i, n, t, , c, o, n, t, r, o, l, l, e, r, , a, r, r, a, n, g, e, m, e, n, t, s, , A, r, t, i, c, l, e, , 2, 6, , G, D, P, R, , g, u, i, d, a, n, c, e.

Security MeasuresGreen

The 2024 FOVELLA/DODO PIZZA CCTV enforcement action illustrates active supervision of security/lawful-basis compliance under national employment-monitoring rules.

Claims (1):

• In a 2024 enforcement action, the Slovenian SA fined FOVELLA d.o.o. (operator of the DODO PIZZA franchise) €25,000 for unlawful CCTV monitoring of employees inside a restaurant kitchen and for unlawfully live-broadcasting that footage on the company's website without a valid Article 6 GDPR legal basis, together with a reprimand for failing to inform data subjects under Article 13 GDPR and Article 76 of ZVOP-2.

Breach NotificationGreen

GDPR Article 33's 72-hour breach-notification standard applies; the Information Commissioner maintains and periodically updates national breach-notification guidance/forms.

Claims (1):

• Controllers in Slovenia must notify the Information Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, per GDPR Article 33.

Retention And DisposalAmber

No Slovenia-specific retention/disposal guidance was identified in this pass beyond the GDPR Article 5(1)(e) storage-limitation baseline.

Absence provenance: No SI-specific secondary source located distinguishing national retention rules from the GDPR baseline.. Searched: S, l, o, v, e, n, i, a, , d, a, t, a, , r, e, t, e, n, t, i, o, n, , d, i, s, p, o, s, a, l, , Z, V, O, P, -, 2, , s, t, o, r, a, g, e, , l, i, m, i, t, a, t, i, o, n.

Transfer MechanismsGreen

GDPR Chapter V transfer mechanisms (adequacy, SCCs, BCRs, derogations) apply directly.

Claims (1):

• GDPR Chapter V transfer mechanisms (adequacy decisions, SCCs, BCRs, derogations) apply directly to Slovenian controllers and processors as EU law.

Adequacy ReceivedGreen

Slovenia is covered by the UK's transitional EU-adequacy regulations, enabling UK-to-Slovenia transfers without additional safeguards.

Claims (1):

• Slovenia, as an EU Member State, is covered by the UK's transitional EU-adequacy regulations, meaning personal data can flow from the UK to Slovenia without additional transfer safeguards.

Adequacy GrantedGreen

As an EU Member State, Slovenia does not independently grant adequacy; this is an EU Commission competence exercised at Union level.

Absence provenance: Adequacy-granting is an EU-level (European Commission) competence for GDPR Member States; no separate Slovenia-level adequacy determinations exist to report.. Searched: S, l, o, v, e, n, i, a, , n, a, t, i, o, n, a, l, , a, d, e, q, u, a, c, y, , d, e, c, i, s, i, o, n, s, , g, r, a, n, t, e, d.

Sccs And BcrsGreen

The Slovenian SA submitted draft national SCCs (Article 28(8) GDPR) to the EDPB for a consistency opinion (Opinion 17/2020).

Claims (1):

• The Slovenian supervisory authority submitted draft national standard contractual clauses under Article 28(8) GDPR to the EDPB for a consistency opinion (Opinion 17/2020), indicating national-level SCC engagement alongside the EU-wide SCC toolkit.

Transfer Impact AssessmentAmber

The EU-wide Schrems II transfer-impact-assessment obligation applies directly to Slovenian exporters; no SI-specific TIA guidance beyond EDPB recommendations was identified.

Absence provenance: No SI-specific TIA guidance distinct from EDPB-wide recommendations was located in this pass.. Searched: S, l, o, v, e, n, i, a, , t, r, a, n, s, f, e, r, , i, m, p, a, c, t, , a, s, s, e, s, s, m, e, n, t, , S, c, h, r, e, m, s, , I, I, , g, u, i, d, a, n, c, e, , I, n, f, o, r, m, a, t, i, o, n, , C, o, m, m, i, s, s, i, o, n, e, r.

Data LocalisationGreen

No Slovenia-specific data-localisation mandate beyond the EU-wide GDPR transfer regime was identified in this research pass.

Absence provenance: No evidence of a partial or absolute data-localisation requirement distinct from the GDPR baseline was located.. Searched: S, l, o, v, e, n, i, a, , d, a, t, a, , l, o, c, a, l, i, s, a, t, i, o, n, , m, a, n, d, a, t, e, , p, e, r, s, o, n, a, l, , d, a, t, a.

Financial Sector OverlayRed

No Slovenia-specific financial-sector DP overlay was identified in this research pass.

Absence provenance: No SI-specific secondary source located on banking-secrecy/financial-sector DP overlay in this pass.. Searched: S, l, o, v, e, n, i, a, , f, i, n, a, n, c, i, a, l, , s, e, c, t, o, r, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , o, v, e, r, l, a, y, , b, a, n, k, i, n, g, , s, e, c, r, e, c, y, , G, D, P, R.

Health Sector OverlayRed

No Slovenia-specific health-sector DP overlay was identified in this research pass.

Absence provenance: No SI-specific secondary source located on health-sector DP overlay in this pass.. Searched: S, l, o, v, e, n, i, a, , h, e, a, l, t, h, , s, e, c, t, o, r, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , o, v, e, r, l, a, y, , p, a, t, i, e, n, t, , d, a, t, a, , G, D, P, R.

Telecoms And EprivacyRed

No Slovenia-specific ePrivacy/telecoms enforcement or transposition detail was confirmed in this research pass.

Absence provenance: No SI-specific secondary source located confirming the national ePrivacy transposition instrument name or recent enforcement.. Searched: S, l, o, v, e, n, i, a, , e, P, r, i, v, a, c, y, , D, i, r, e, c, t, i, v, e, , t, r, a, n, s, p, o, s, i, t, i, o, n, , t, e, l, e, c, o, m, s, , c, o, o, k, i, e, s, , e, n, f, o, r, c, e, m, e, n, t.

Employment DataGreen

ZVOP-2 Article 78 imposes an ultima ratio standard restricting employee video surveillance, confirmed via the 2024 FOVELLA enforcement action.

Claims (1):

• ZVOP-2 Article 78 imposes an ultima ratio (last-resort) standard restricting employee video surveillance to circumstances absolutely necessary for the safety of people or property, a national employment-data overlay stricter than default GDPR Article 6 balancing.

Credit And ScoringRed

No Slovenia-specific credit-scoring DP overlay was identified in this research pass.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , c, r, e, d, i, t, , s, c, o, r, i, n, g, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , o, v, e, r, l, a, y.

EducationGreen

The 2025 school case confirms an operative education-sector DP overlay concerning minors' data and third-party processor access.

Claims (1):

• The Slovenian SA's 2025 enforcement action against a school over unauthorized meal-service-provider access to student data confirms an operative education-sector overlay of GDPR Article 25 data-protection-by-design duties.

InsuranceRed

No Slovenia-specific insurance-sector DP overlay was identified in this research pass.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , i, n, s, u, r, a, n, c, e, , s, e, c, t, o, r, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , o, v, e, r, l, a, y.

Cookies And TrackersAmber

Cookie/tracker consent is presumed governed by the national ePrivacy transposition alongside GDPR consent standards; the specific national instrument name was not independently verified in this pass.

Claims (1):

• Cookie and tracker consent in Slovenia is presumed governed by the national transposition of the ePrivacy Directive (2002/58/EC) operating alongside GDPR consent standards and enforced by the Information Commissioner; no Slovenia-specific adtech enforcement action was identified in this research pass.

Dark PatternsRed

No SI-specific dark-pattern enforcement was identified in this research pass.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , d, a, r, k, , p, a, t, t, e, r, n, s, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , e, n, f, o, r, c, e, m, e, n, t.

Opt Out SignalsRed

No SI-specific Global Privacy Control/DAA opt-out signal guidance was identified in this research pass.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , G, l, o, b, a, l, , P, r, i, v, a, c, y, , C, o, n, t, r, o, l, , o, p, t, -, o, u, t, , s, i, g, n, a, l, , g, u, i, d, a, n, c, e.

Clean Rooms And DcrRed

No SI-specific data clean-room/collaboration-room guidance was identified in this research pass.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , d, a, t, a, , c, l, e, a, n, , r, o, o, m, , d, a, t, a, , c, o, l, l, a, b, o, r, a, t, i, o, n, , r, o, o, m, , g, u, i, d, a, n, c, e.

Cross Context AdvertisingRed

No SI-specific cross-context advertising enforcement or guidance was identified in this research pass.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , c, r, o, s, s, -, c, o, n, t, e, x, t, , a, d, v, e, r, t, i, s, i, n, g, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , e, n, f, o, r, c, e, m, e, n, t.

Direct MarketingAmber

No SI-specific direct-marketing consent/suppression guidance was identified in this research pass beyond the GDPR/ePrivacy baseline.

Absence provenance: No SI-specific secondary source located distinct from the GDPR/ePrivacy baseline.. Searched: S, l, o, v, e, n, i, a, , d, i, r, e, c, t, , m, a, r, k, e, t, i, n, g, , c, o, n, s, e, n, t, , s, u, p, p, r, e, s, s, i, o, n, , l, i, s, t, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n.

Profiling RestrictionsAmber

GDPR Article 22 profiling restrictions apply directly; no SI-specific elaboration identified in this pass.

Absence provenance: No SI-specific secondary source located beyond the GDPR baseline.. Searched: S, l, o, v, e, n, i, a, , p, r, o, f, i, l, i, n, g, , r, e, s, t, r, i, c, t, i, o, n, s, , A, r, t, i, c, l, e, , 2, 2, , G, D, P, R, , g, u, i, d, a, n, c, e.

Automated Decision Making TransparencyAmber

GDPR Article 22 ADM transparency/explanation rights apply directly; no SI-specific elaboration identified in this pass.

Absence provenance: No SI-specific secondary source located beyond the GDPR baseline.. Searched: S, l, o, v, e, n, i, a, , a, u, t, o, m, a, t, e, d, , d, e, c, i, s, i, o, n, , m, a, k, i, n, g, , t, r, a, n, s, p, a, r, e, n, c, y, , g, u, i, d, a, n, c, e.

Ai Risk AssessmentsGreen

The Information Commissioner co-signed a February 2026 international joint statement on AI-generated imagery and privacy risk.

Claims (1):

• The Information Commissioner of the Republic of Slovenia is a signatory to a February 2026 multi-regulator Joint Statement on AI-Generated Imagery and the Protection of Privacy, alongside other global data protection and privacy authorities.

Biometric RegimeGreen

ZVOP-2 contains a dedicated national legal framework regulating biometric data processing.

Claims (1):

• ZVOP-2 contains a dedicated national legal framework regulating biometric data processing, operating as a national specification permitted under GDPR Article 9(4).

Genetic DataAmber

No SI-specific genetic-data regime elaboration was identified in this research pass beyond the GDPR Article 9 baseline.

Absence provenance: No SI-specific secondary source located beyond the GDPR Article 9 baseline.. Searched: S, l, o, v, e, n, i, a, , g, e, n, e, t, i, c, , d, a, t, a, , Z, V, O, P, -, 2, , s, p, e, c, i, a, l, , c, a, t, e, g, o, r, y, , r, e, g, i, m, e.

State Surveillance CarveoutsGreen

ZVOP-2 separately regulates video surveillance in public areas as a national carve-out area addressed alongside GDPR's general processing rules.

Claims (1):

• ZVOP-2 separately regulates video surveillance in public areas, addressed alongside (not superseding) GDPR's general processing rules.

Age VerificationAmber

Slovenia's specific national age-of-consent threshold was not confirmed in this research pass.

Claims (1):

• Slovenia's specific national age-of-consent threshold under the GDPR Article 8 derogation for children's consent to information-society services was not confirmed in this research pass; absent a confirmed derogation, the GDPR default age of 16 would presumptively apply.

Parental ConsentAmber

GDPR Article 8 parental-consent mechanics apply as the presumed baseline absent a confirmed national derogation.

Absence provenance: No SI-specific secondary source located confirming national parental-consent verification mechanics.. Searched: S, l, o, v, e, n, i, a, , p, a, r, e, n, t, a, l, , c, o, n, s, e, n, t, , m, e, c, h, a, n, i, s, m, , G, D, P, R, , A, r, t, i, c, l, e, , 8, , Z, V, O, P, -, 2.

Minor Profiling BansRed

No Slovenia-specific minor-profiling ban was identified in this research pass beyond the GDPR Recital 38 baseline caution on profiling minors.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , m, i, n, o, r, , p, r, o, f, i, l, i, n, g, , b, a, n, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n.

Education SettingsGreen

The 2025 school case is direct evidence of operative enforcement protecting minors' data in the education setting.

Claims (1):

• The 2025 Slovenian SA decision addressing unauthorized third-party access to a school's student database (including minors' subsidy and financial data) demonstrates operative enforcement of data-protection-by-design duties in the education setting for minors' data.

Dependent AdultsRed

No Slovenia-specific dependent-adult data-protection provisions were identified in this research pass.

Absence provenance: No SI-specific secondary source located.. Searched: S, l, o, v, e, n, i, a, , d, e, p, e, n, d, e, n, t, , a, d, u, l, t, s, , e, l, d, e, r, l, y, , i, n, c, a, p, a, c, i, t, a, t, e, d, , d, a, t, a, , p, r, o, t, e, c, t, i, o, n, , p, r, o, v, i, s, i, o, n, s.

Regulator Powers And PenaltiesGreen

The Information Commissioner may impose GDPR Article 83 maximum fines and other corrective measures (reprimands, processing bans).

Claims (1):

• The Information Commissioner may impose administrative fines up to the GDPR Article 83 maxima (up to €20 million or 4% of global annual turnover, whichever is higher, for the most serious infringements), alongside corrective powers such as reprimands and processing bans.

Enforcement Activity IndexGreen

2023 annual report figures and the 2024 FOVELLA fine evidence active enforcement.

Claims (2):

• During 2023, Slovenia's Information Commissioner received, handled, and advised on 1,146 requests to open investigation procedures, including 7 cases of unauthorized processing, as reported in its annual report submitted to the National Assembly on 21 May 2024.
• In 2024, the Slovenian SA imposed a €25,000 administrative fine on FOVELLA d.o.o. for unlawful employee CCTV monitoring and unlawful live broadcast of that footage, together with a reprimand for transparency failures.

Regulator Funding And CapacityAmber

No specific headcount/budget figures for the Information Commissioner were identified in this research pass.

Absence provenance: No SI-specific secondary source with funding/headcount figures was located in this pass.. Searched: S, l, o, v, e, n, i, a, , I, n, f, o, r, m, a, t, i, o, n, , C, o, m, m, i, s, s, i, o, n, e, r, , b, u, d, g, e, t, , h, e, a, d, c, o, u, n, t, , c, a, p, a, c, i, t, y, , 2, 0, 2, 5, , 2, 0, 2, 6.

Collective Redress And Class ActionsAmber

GDPR Article 80 representative-action mechanics apply directly; no SI-specific collective-redress expansion was confirmed.

Claims (1):

• GDPR Articles 79-80 provide data subjects in Slovenia with a direct judicial remedy against controllers/processors and the right to mandate a not-for-profit body to lodge complaints or seek judicial remedy on their behalf; no SI-specific expansion of collective redress beyond the GDPR baseline was confirmed in this pass.

Private Right Of ActionGreen

GDPR Article 79 provides a direct judicial remedy for data subjects against controllers/processors in Slovenia.

Claims (1):

• GDPR Articles 79-80 provide data subjects in Slovenia with a direct judicial remedy against controllers/processors and the right to mandate a not-for-profit body to lodge complaints or seek judicial remedy on their behalf; no SI-specific expansion of collective redress beyond the GDPR baseline was confirmed in this pass.

Recent Developments 180DGreen

Within the recent reporting window, the Slovenian SA is running the 2025 EDPB right-to-erasure coordinated enforcement action and co-signed a February 2026 joint statement on AI-generated imagery privacy risk.

Claims (1):

• The Slovenian SA is running its 2025 EDPB Coordinated Enforcement Framework action on the right to erasure and issued a May 2025 decision on school data-protection-by-design failures; a February 2026 joint international statement on AI-generated imagery privacy risks was also co-signed by the Slovenian Information Commissioner.