Slovenia

Two layers stack. The General Data Protection Regulation reaches non-European controllers directly under its Article 3(2), and Article 27 requires a representative established in one of the member states where the affected people are. Slovenia's own act, ZVOP-2 (Zakon o varstvu osebnih podatkov, Official Gazette 163/22), sets its territorial reach in Article 4: it applies to processing carried out in the course of the activities of an establishment in Slovenia, and to processing of people in Slovenia by controllers outside the European Union, regardless of where the processing physically happens. ZVOP-2 does not add a separate Slovenia-only representative on top of the European one. Sector statutes are narrower and reach only the regulated firm: the Health Digitalisation Act binds healthcare providers operating in Slovenia and the state company running the central system, the Games of Chance Act binds concession holders, and the Information Security Act binds essential and important entities providing services in Slovenia.

Sector by sector, checked on 18 August 2026. HEALTH — data must stay in the country for the central system. The Health Digitalisation Act (Zakon o digitalizaciji zdravstva, ZDigZ, Official Gazette 100/25 of 4 December 2025) creates a wholly state-owned company to run the central health information and communication infrastructure and the central electronic health record. Article 7(7) says of that company: 'Osebnih podatkov kot pogodbeni obdelovalec ne sme obdelovati za svoje namene in jih ne sme niti prenašati niti hraniti izven ozemlja Republike Slovenije' — as a contractual processor it may not process the personal data for its own purposes and may neither transfer nor store them outside the territory of the Republic of Slovenia. Article 3(2) requires all healthcare providers to connect their local health information systems to that central infrastructure. The practical effect is that the national health record is legally pinned to Slovenian soil, and a cloud offer routed through the state company cannot sit abroad. It does not, on its face, stop an individual private clinic from using a European cloud for its own local records — but that reading is ours and is flagged as unconfirmed. GOVERNMENT — data can leave with the right paperwork, but very tight. The Decree on information security in state administration (Uredba o informacijski varnosti v državni upravi, Official Gazette 29/18) allows cloud services in Article 41 only for information assets that are unclassified or in the lowest tiers Z1, C1 and R1, and only with the written approval of the ministry, which must first check the provider's terms. EMPLOYMENT — a copy must stay in the country. Since 20 November 2023, Article 19(5) of the Records in the Field of Labour and Social Security Act as amended (ZEPDSV-A, Official Gazette 50/23) requires the employer to keep the working-time record and the underlying documents 'na sedežu oziroma na kraju opravljanja dela delavca' — at its registered office or at the place where the worker performs the work. A cloud copy is fine; an inspector turning up must still be shown the record on the spot. GAMBLING — establishment wall rather than a data wall. Only a joint-stock company with its registered seat in Slovenia may organise games of chance (Games of Chance Act, Articles 30 and 55), and an internet operator must connect its information system to the supervisory authority's information system (Article 3a). We found no provision requiring the server itself to sit in Slovenia. CHECKED AND NO STORAGE-LOCATION RULE FOUND: banking, payments, insurance, securities, telecoms, education, mapping and aerial survey, and defence-adjacent commercial work. Slovenia's financial regulators point firms at the European digital operational resilience rules, which demand contracts, exit plans and disclosure of where data sits, but not a location. Slovenia's new Aviation Act (ZLet-1, Official Gazette 85/24) contains no aerial-photography permit or imagery-deposit duty of the kind several neighbours have.

The approved list is real and populated: Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for entities self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. No adequacy decision has been withdrawn or suspended. The 2021 standard contractual clauses, Decision (EU) 2021/914, remain the operative set and are unamended; the promised new clauses for importers already directly subject to the Regulation under Article 3(2) are still not adopted as at 18 August 2026, and market practice is to use the 2021 clauses with duplicative terms disapplied. Binding corporate rules remain available. Article 49 derogations are narrow and are not for systematic or large-scale transfers. A transfer impact assessment is still expected after Schrems II. The EU-US Data Privacy Framework is still in force and legally valid on 18 August 2026 but is under pressure on two fronts: the General Court dismissed the Latombe challenge on 3 September 2025 and an appeal to the Court of Justice was lodged on 31 October 2025 and is pending; and on 31 July 2026 the European Data Protection Board formally wrote to the Commission asking it to examine whether United States institutional changes affect the decision's validity. The Commission has not suspended or revoked it. Practical advice: usable today, never as your only mechanism. Separately, European Data Protection Board Guidelines 02/2024 confirm that an order from a third-country authority is not by itself a lawful basis to hand data over. Regulation (EU) 2018/1807 forbids Slovenia from imposing localisation on non-personal data except on public-security grounds — the ground the health and government-cloud rules would have to justify themselves against if challenged.

Informacijski pooblaščenec (the Information Commissioner) is both the data protection authority and the freedom-of-information authority. Dr. Jelena Virant Burnik took office as Commissioner in 2024. Its 2025 annual report to the National Assembly records 464 inspection procedures started on the basis of complaints, 102 started on inspection reports, 176 advisory letters to controllers, 134 decisions in minor-offence proceedings of which 89 ended in a fine and 45 in a warning, and 153 personal data breach notifications received. Staffing at 31 December 2025 was one appointed official and 53 public employees, and the report states plainly that the existing workforce cannot absorb the growing caseload and the office's widening remit. Rating: active, not aggressive — high case volume, real fines, but a small office that leans on warnings for minor breaches. The second enforcer is the Government Office for Information Security (Urad Vlade Republike Slovenije za informacijsko varnost, URSIV), which runs registration, incident reporting and supervision under the Information Security Act of 2025 and which is publishing guidance, model documents and conference material — evidence of an operating regulator rather than a paper one. The Financial Administration supervises gambling, the Bank of Slovenia supervises banks, the Insurance Supervision Agency insurers and the Securities Market Agency investment firms; all four are long-established and operational.

FLOORS. Health: the Health Care Databases Act (Zakon o zbirkah podatkov s področja zdravstvenega varstva, ZZPPZ, Official Gazette 65/00 with later amendments) sets the periods in its Annex 1 — the Information Commissioner's published opinion states that the medical file and the description of illness are kept for ten years after the patient's death, and other basic medical documentation for fifteen years, and that a living patient's file may not be destroyed however long since their last visit. Access and processing logs: Article 22 of ZVOP-2 requires controllers of designated databases to record each collection, change, access, disclosure and deletion with a timestamp and user identity, and to keep the content of that log for two years after the end of the calendar year, extendable to five years where a risk assessment justifies it — this is the obligation most often missed by organisations whose global logging pipeline expires records after 30 or 90 days. Employment: working-time records and the underlying documents must be held at the employer's registered office or the worker's place of work. Tax and accounting minimums also exist under Slovenian tax and company law and are typically ten years, but we could not verify those periods against a government page on this run — see the unconfirmed list. CEILING. There is no Slovenian deletion clock separate from the European one: personal data must not be kept in identifiable form for longer than the purpose requires, and individuals can ask for erasure. Where a floor and a ceiling collide, the specific statutory retention period wins for as long as it runs, and deletion becomes due the moment it expires — the Commissioner puts it as: once the prescribed period has passed, access is no longer possible because the data must by then be destroyed, deleted, blocked or anonymised.

Clock one: Article 33 of the General Data Protection Regulation — notify the Information Commissioner without undue delay and where feasible within 72 hours of becoming aware, and tell affected individuals without undue delay where the risk to them is high. The Commissioner received 153 such notifications in 2025. Clock two: the Information Security Act 2025 (Zakon o informacijski varnosti, ZInfV-1, Official Gazette 40/25) for essential and important entities. The Government Office for Information Security states the sequence as an early warning 'nemudoma / v 24 urah' (immediately, within 24 hours), a notification 'v 72 urah' (within 72 hours), and a final report 'najpozneje v enem mesecu' (no later than one month). Healthcare providers are expressly listed as an essential sector, so a Slovenian hospital hit by ransomware is running clocks one and two simultaneously. Clock three: telecoms operators under the Electronic Communications Act 2022 have separate security-incident and personal-data-breach duties to the sector regulator, and the European rules on notification by telecoms providers still apply to them. A fourth clock exists for banks, insurers and investment firms: major information and communications technology incidents must be reported under the European digital operational resilience rules, which have applied since 17 January 2025.

(1) AGE 15. Article 8 of ZVOP-2 sets the age at which a child can validly consent to an online service at 15: 'Privolitev otroka za uporabo storitev informacijske družbe ... je veljavna, če je otrok star 15 let ali več.' Products built to a single European age of 16 are wrong in Slovenia in the permissive direction, which is the safer error, but products built to 13 are wrong in the dangerous direction. (2) BIOMETRICS. The Information Commissioner states that processing biometric data contrary to ZVOP-2 is prohibited outright, that linking biometric databases and transferring such data is restricted unless a law allows it, and that private-sector use is confined to specific purposes and requires the Commissioner's approval. A face-recognition time clock cannot simply be bought and switched on. (3) LOGGING. Article 22 of ZVOP-2 requires a processing log for designated databases recording who did what to which personal data and when, kept for two years after the calendar year ends and up to five years on a risk assessment. This is a Slovenian addition to the European rules and it bites on architecture, not paperwork. (4) CRIMINAL LIABILITY. Article 143 of the Criminal Code makes misuse of personal data an offence. The Commissioner states that the ordinary forms under the first and second paragraphs carry a fine or imprisonment of up to one year, and that prosecution is time-barred six years after the act. This attaches to individuals, not only to companies. (5) RECORDS AT THE WORKPLACE. Article 19(5) of the amended labour records act requires the working-time record and its supporting documents to be kept at the employer's registered office or at the place where the worker works. A foreign employer with staff in Slovenia and everything in a foreign system has a problem an inspector can see. (6) BONUS TRAP — E-ARCHIVING. Anyone offering digital capture or storage services for documentary material in Slovenia must register with the Archives of the Republic of Slovenia at least eight days before starting, and for archival material may use only equipment and services certified by the state archive. Certification fees run from about 300 to 2,000 euros (roughly $330 to $2,200). This catches document-management vendors who assume a standard processor contract is enough.

19 DECEMBER 2026 — the Information Security Act (ZInfV-1) entered into force on 19 June 2025. Organisations already covered by the previous act had until 19 June 2026 to comply; newly captured essential and important entities have until 19 December 2026. Self-registration with the Government Office for Information Security is the mechanism, and it is a change from the old regime where the state designated who was in scope. 12 JANUARY 2027 — the European Data Act, applicable since 12 September 2025, requires all cloud switching charges and data egress fees to fall to zero. Its Chapter VII also restricts third-country government access to non-personal data held in Europe. HEALTH ROLL-OUT — the Health Digitalisation Act was published on 4 December 2025. It creates the state-owned company for central health information infrastructure, requires every healthcare provider to connect, and forbids that company from transferring or storing personal data outside Slovenia. The commencement and phase-in dates are the single most important thing we could not confirm from a government text on this run. DORMANT SWITCHES — powers already held that could change the picture with no consultation: (1) the ministry's power under the state administration information security decree to grant or refuse cloud approvals, and to reclassify information assets into a tier where public cloud is simply not available; (2) the government's power to widen the scope of essential and important entities by decree under the Information Security Act; (3) the Article 7 localisation duty in the health act, whose reach into sub-processors and suppliers is untested and could be read broadly by the ministry without any new law. At European level, the EU-US Data Privacy Framework remains the largest single point of failure: valid today, appealed to the Court of Justice, and the subject of a formal European Data Protection Board letter to the Commission on 31 July 2026.