Slovenia

Two layers stack up. The General Data Protection Regulation reaches companies outside Europe directly, under its Article 3(2). Article 27 requires a representative based in one of the member states where the affected people are. Slovenia's own act is ZVOP-2 (Zakon o varstvu osebnih podatkov, Official Gazette 163/22). Article 4 sets how far it reaches. It applies to data used in the course of the activities of a business based in Slovenia. It also applies to data about people in Slovenia handled by companies outside the European Union, wherever the work physically happens. ZVOP-2 does not add a separate Slovenia-only representative on top of the European one. Industry laws are narrower and reach only the regulated firm. The Health Digitalisation Act binds healthcare providers operating in Slovenia and the state company running the central system. The Games of Chance Act binds concession holders. The Information Security Act binds essential and important entities providing services in Slovenia.

Industry by industry, checked on 18 August 2026. HEALTH — data must stay in the country for the central system. The Health Digitalisation Act (Zakon o digitalizaciji zdravstva, ZDigZ, Official Gazette 100/25 of 4 December 2025) creates a wholly state-owned company. That company runs the central health information and communication infrastructure and the central electronic health record. Article 7(7) says the company may not use the personal data for its own purposes. It also says the company may neither transfer nor store that data outside the territory of the Republic of Slovenia. Article 3(2) requires all healthcare providers to connect their local health information systems to that central infrastructure. So the national health record is legally pinned to Slovenian soil. A cloud offer routed through the state company cannot sit abroad. On its face this does not stop a private clinic from using a European cloud for its own local records. That reading is ours, and it is flagged as unconfirmed. GOVERNMENT — data can leave only if conditions are met, but very tight. The Decree on information security in state administration (Uredba o informacijski varnosti v državni upravi, Official Gazette 29/18) allows cloud services in Article 41. It allows them only for information that is unclassified or in the lowest tiers Z1, C1 and R1. It also requires the written approval of the ministry, which must first check the provider's terms. EMPLOYMENT — a copy must stay in the country Since 20 November 2023 there has been a rule about where the record is kept. It is Article 19(5) of the Records in the Field of Labour and Social Security Act as amended (ZEPDSV-A, Official Gazette 50/23). The employer keeps the working-time record and the documents behind it at its registered office, or at the place where the worker performs the work. A cloud copy is fine. An inspector who turns up must still be shown the record on the spot. GAMBLING — a rule about where the company sits, not where the data sits. Only a joint-stock company with its registered seat in Slovenia may organise games of chance (Games of Chance Act, Articles 30 and 55). An internet operator must connect its information system to the supervisory authority's information system (Article 3a). We found no rule requiring the server itself to sit in Slovenia. CHECKED AND NO RULE FOUND ON WHERE DATA MUST BE STORED: banking, payments, insurance, securities, telecoms, education, mapping and aerial survey, and defence-adjacent commercial work. Slovenia's financial regulators point firms at the European digital operational resilience rules. Those rules demand contracts, exit plans and disclosure of where data sits. They do not demand a location. Slovenia's new Aviation Act (ZLet-1, Official Gazette 85/24) contains no aerial-photography permit or imagery-deposit duty of the kind several neighbours have.

The approved list is real and well populated. It covers Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan and Jersey. It also covers New Zealand, South Korea (first review confirmed 23 July 2026) and Switzerland. And it covers the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay and the European Patent Organisation. The United States counts for companies self-certified under the EU-US Data Privacy Framework. No approval decision has been withdrawn or suspended. The 2021 standard contractual clauses, Decision (EU) 2021/914, remain the set in use and are unchanged. New clauses were promised for recipients already covered directly by the Regulation under Article 3(2). Those are still not adopted as at 18 August 2026. Most companies use the 2021 clauses instead, switching off the terms that duplicate. Binding corporate rules remain available. The Article 49 exceptions are narrow and are not for regular or large-scale transfers. You are still expected to write a transfer risk assessment after the Schrems II judgment. The EU-US Data Privacy Framework is still in force and legally valid on 18 August 2026. But it is under pressure on two fronts. The General Court dismissed the Latombe challenge on 3 September 2025. An appeal to the Court of Justice was lodged on 31 October 2025 and is pending. And on 31 July 2026 the European Data Protection Board formally wrote to the Commission. It asked the Commission to examine whether changes to United States institutions affect the decision's validity. The Commission has not suspended or revoked it. Our advice: use it today, but never as your only route. Separately, European Data Protection Board Guidelines 02/2024 confirm that an order from a non-European authority is not by itself a lawful reason to hand data over. Regulation (EU) 2018/1807 forbids Slovenia from making non-personal data stay in the country, except on public-security grounds. That is the ground the health and government-cloud rules would have to justify themselves against if challenged.

Informacijski pooblaščenec, the Information Commissioner, is both the data protection authority and the freedom-of-information authority. Dr. Jelena Virant Burnik took office as Commissioner in 2024. Its 2025 annual report to the National Assembly gives the numbers. It started 464 inspection procedures on the basis of complaints and 102 on the basis of inspection reports. It sent 176 advisory letters to organisations. It issued 134 decisions in minor-offence proceedings, of which 89 ended in a fine and 45 in a warning. It received 153 personal data breach notifications. Staffing at 31 December 2025 was one appointed official and 53 public employees. The report states plainly that this workforce cannot absorb the growing caseload and the office's widening remit. Our rating is active, not aggressive. Case volume is high and the fines are real, but a small office leans on warnings for minor breaches. The second enforcer is the Government Office for Information Security (Urad Vlade Republike Slovenije za informacijsko varnost, URSIV). It runs registration, incident reporting and supervision under the Information Security Act of 2025. It is publishing guidance, model documents and conference material, which shows a regulator that operates rather than one that exists on paper. The Financial Administration supervises gambling. The Bank of Slovenia supervises banks. The Insurance Supervision Agency supervises insurers, and the Securities Market Agency supervises investment firms. All four are long-established and working.

MINIMUMS. Health. The Health Care Databases Act sets the periods in its Annex 1. That is Zakon o zbirkah podatkov s področja zdravstvenega varstva, ZZPPZ, Official Gazette 65/00 with later amendments. The Information Commissioner's published opinion says the medical file and the description of illness are kept for ten years after the patient's death. Other basic medical documentation is kept for fifteen years. A living patient's file may not be destroyed, however long since their last visit. Access and activity logs. Article 22 of ZVOP-2 covers named databases. You must record each collection, change, access, disclosure and deletion, with a timestamp and the user's identity. You must keep the contents of that log for two years after the end of the calendar year. That extends to five years where a risk assessment justifies it. This is the duty most often missed by organisations whose global logging pipeline deletes records after 30 or 90 days. Employment. Working-time records and the documents behind them must be held at the employer's registered office or the worker's place of work. Tax and accounting minimums also exist under Slovenian tax and company law, and are typically ten years. We could not verify those periods against a government page. See the unconfirmed list. MAXIMUM. Slovenia has no deletion deadline separate from the European one. Personal data must not be kept in a form that identifies people for longer than the purpose requires, and people can ask for erasure. Where a minimum and a maximum collide, the specific legal keeping period wins for as long as it runs. Deletion becomes due the moment it expires. The Commissioner puts it this way. Once the set period has passed, access is no longer possible, because the data must by then be destroyed, deleted, blocked or anonymised.

Deadline one. Article 33 of the General Data Protection Regulation. Tell the Information Commissioner without undue delay, and where possible within 72 hours of becoming aware. Tell the affected people without undue delay where the risk to them is high. The Commissioner received 153 such notifications in 2025. Deadline two. The Information Security Act 2025 (Zakon o informacijski varnosti, ZInfV-1, Official Gazette 40/25), for essential and important entities. The Government Office for Information Security sets out the sequence. An early warning immediately, and in any case within 24 hours. A notification within 72 hours. A final report no later than one month. Healthcare providers are expressly listed as an essential sector. So a Slovenian hospital hit by ransomware is running deadlines one and two at the same time. Deadline three. Telecoms operators under the Electronic Communications Act 2022 have separate security-incident and personal-data-breach duties to their own regulator. The European rules on notification by telecoms providers still apply to them as well. A fourth deadline exists for banks, insurers and investment firms. Major information and communications technology incidents must be reported under the European digital operational resilience rules, which have applied since 17 January 2025.

(1) AGE 15. Article 8 of ZVOP-2 sets the age at which a child can validly consent to an online service at 15. A product built to a single European age of 16 is wrong in Slovenia, but wrong in the permissive direction, which is the safer error. A product built to 13 is wrong in the dangerous direction. (2) BIOMETRICS. The Information Commissioner says that using biometric data contrary to ZVOP-2 is banned outright. Linking biometric databases and sending such data abroad is restricted unless a law allows it. Private-sector use is confined to specific purposes and needs the Commissioner's approval. You cannot simply buy a face-recognition time clock and switch it on. (3) LOGGING. Article 22 of ZVOP-2 requires an activity log for named databases. It must record who did what to which personal data, and when. You keep it for two years after the calendar year ends, and up to five years on a risk assessment. This is a Slovenian addition to the European rules, and it lands on your architecture rather than your paperwork. (4) CRIMINAL LIABILITY. Article 143 of the Criminal Code makes misuse of personal data an offence. The Commissioner says the ordinary forms, under the first and second paragraphs, carry a fine or up to one year in prison. Prosecution is time-barred six years after the act. This applies to individuals, not only to companies. (5) RECORDS AT THE WORKPLACE. Article 19(5) of the amended labour records act covers the working-time record and its supporting documents. They must be kept at the employer's registered office, or at the place where the worker works. A foreign employer with staff in Slovenia and everything in a foreign system has a problem an inspector can see. (6) ONE MORE TRAP: E-ARCHIVING. Anyone offering digital capture or storage services for documentary material in Slovenia must register with the Archives of the Republic of Slovenia. You register at least eight days before you start. For archival material you may use only equipment and services certified by the state archive. Certification fees run from about 300 to 2,000 euros (roughly 330 to 2,200 US dollars). This catches document-management suppliers who assume a standard data protection contract is enough.

19 DECEMBER 2026 — the Information Security Act (ZInfV-1) came into force on 19 June 2025. Organisations already covered by the previous act had until 19 June 2026 to comply. Newly covered essential and important entities have until 19 December 2026. You register yourself with the Government Office for Information Security. That is a change from the old system, where the state decided who was covered. 12 JANUARY 2027 — the European Data Act requires all cloud switching charges and data export fees to fall to zero. That Act has applied since 12 September 2025. Its Chapter VII also limits access by non-European governments to non-personal data held in Europe. HEALTH ROLL-OUT — the Health Digitalisation Act was published on 4 December 2025. It creates the state-owned company for central health information infrastructure. It requires every healthcare provider to connect. And it forbids that company from transferring or storing personal data outside Slovenia. Its start and phase-in dates are the single most important thing we could not confirm from a government text. POWERS ALREADY HELD, which could change your answer with no consultation. (1) The ministry's power under the state administration information security decree to grant or refuse cloud approvals. It can also move information into a tier where public cloud is simply not available. (2) The government's power to widen who counts as an essential or important entity, by decree under the Information Security Act. (3) The Article 7 duty in the health act to keep data in Slovenia. How far it reaches into sub-suppliers is untested, and the ministry could read it broadly with no new law. At European level, the EU-US Data Privacy Framework is the largest single point of failure. It is valid today, but it is under appeal at the Court of Justice. It is also the subject of a formal European Data Protection Board letter to the Commission, dated 31 July 2026.