Slovakia

Two layers stack. The General Data Protection Regulation applies directly in Slovakia and reaches controllers outside the European Union under Article 3(2) where they offer goods or services to people in the Union or monitor their behaviour; Article 27 then requires a written representative established in a member state where the affected people are. On top of that, section 3(4) of Act 18/2018 Coll. sets out Slovakia's own territorial reach: point (a) catches any controller or processor with a registered office, place of business, branch, establishment or permanent residence in Slovakia 'regardless of whether the processing is carried out inside or outside the territory of the Slovak Republic', and point (c) catches processing of people located in Slovakia by a controller established outside the member states. That last phrase in point (a) is also the clearest textual confirmation that Slovak law does not care where the servers are. There is no Slovak registration or licensing step before you may process personal data — the old notification duty went with the 1998 and 2013 Acts. A data protection officer must be notified to the authority when one is appointed, using the authority's own form. Note that Act 18/2018 is on its way out: the authority has two replacement bills in the legislative pipeline (see question eight), but on 18 August 2026 they are still bills.

SECTOR BY SECTOR, checked 18 August 2026. GAMING — a hard wall. Section 14(22) of Act 30/2019 Coll. on gambling: 'Server je prevádzkovateľ hazardnej hry povinný umiestniť na území Slovenskej republiky' — the gambling operator must place the server on Slovak territory. The same section requires the server to record every game played, every stake and win, every intervention in the game software and, for online games, every player-account movement. Section 14(21) requires the operator to give the gambling regulator free, online access to that server. This is stricter than Hungary's equivalent, which allows anywhere in the European Economic Area. Rating: closed GOVERNMENT — a hard wall at the top tier only. Section 24a of Act 95/2019 Coll. lets the ministry set standards that force public bodies, when acting on people's rights and duties, to use only cloud services entered in the government cloud catalogue. The binding methodological guidance of 11 April 2025 (ref. 020775/2025/oSBATA, effective 15 April 2025) sets four categories. Category U4, 'special data', is defined as data 'ktoré však vyžadujú uchovávanie a spracovávanie dát na území SR a v dátovom centre, ktoré je v dosahu štátnych orgánov SR, v privátnej časti vládneho cloudu' — requiring storage and processing on Slovak territory, in a data centre within reach of Slovak state authorities, in the private part of the government cloud. Categories U1 to U3 carry no location requirement, but the questionnaire demands a full list of data-centre locations, expressly flagged as important 'pri uchovávaní osobných údajov mimo EÚ'. Only the Ministry of the Interior (with the Ministry of Finance data centre) may supply the private infrastructure-as-a-service and platform-as-a-service layer. Registration lasts two years and lapses automatically if not renewed. Rating: data must stay in the country for U4, data can leave once conditions are met below it. GEOSPATIAL — a copy must stay. Section 8 of Act 215/1995 Coll. on geodesy and cartography requires anyone who acquires primary aerial remote-sensing material or aerial survey photographs to report it within 30 days and, after use, hand it over free of charge to a special archive run by the Ministry of Defence. Publishers of cartographic works must deposit two analogue copies and, if it exists in digital form, one digital copy with the archive of the Geodesy, Cartography and Cadastre Authority within 30 days, plus one more with the Ministry of Defence archive. You keep your own copy and may take it abroad, so this is a mirror duty, not an export ban. Rating: mirror BANKING, PAYMENTS, INSURANCE, SECURITIES — no localisation found. The central bank's own cloud computing page tells institutions that using a public cloud does not relieve them of responsibility for confidentiality, integrity and availability, and points them to the European Banking Authority outsourcing recommendations; it states no location rule. Its insurance outsourcing page says only critical or important operational functions must be notified in advance under section 30(3) of the Insurance Act, and expressly contemplates providers in other member states or third countries meeting Article 274 of Delegated Regulation 2015/35. The Digital Operational Resilience Act has applied to financial entities since 17 January 2025 and requires the processing location to be named in the contract, with audit rights and an exit plan — disclosure, not residency. Rating: conditional HEALTH — no localisation found. Act 153/2013 Coll. on the national health information system contains no territorial storage rule; the national system itself is state-operated and physically in Slovakia, but that is an operating fact about a state system, not a rule binding private controllers. What it does contain is extremely long retention (see question five). TELECOM — no localisation found, and less retention than most people expect (see question five). EDUCATION, E-COMMERCE, SOCIAL MEDIA, ARTIFICIAL INTELLIGENCE — no Slovak storage-location rule found, checked 18 August 2026. DEFENCE AND CLASSIFIED MATERIAL — not researched in depth. Classified information is governed by a separate regime (Act 215/2004 Coll.) which we did not verify; treat anything classified as out of scope of this record.

Section 48 of Act 18/2018 Coll. mirrors Chapter V of the General Data Protection Regulation: transfer on the basis of a Commission adequacy decision, or failing that on appropriate safeguards, or failing that on a derogation. The Slovak authority runs the notification and approval forms for transfers to third countries, for approving contractual clauses and for approving binding corporate rules, and lists them on its own site. The 2021 standard contractual clauses (Decision (EU) 2021/914) remain the operative set and are unamended; the promised new clauses for importers already directly subject to the Regulation under Article 3(2) are still not adopted as at 18 August 2026. A transfer impact assessment is still expected after Schrems II. The EU-US Data Privacy Framework is still in force and legally valid on 18 August 2026, but it is under pressure: the General Court dismissed the Latombe challenge on 3 September 2025 and an appeal to the Court of Justice was lodged on 31 October 2025 and is pending, and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether US institutional changes affect the decision's validity. The Commission has not suspended or revoked it. Practical advice: usable, but never as your only mechanism. Separately, EDPB Guidelines 02/2024 on Article 48 confirm that an order from a third-country authority is not by itself a lawful basis to hand data over. Regulation (EU) 2018/1807 forbids Slovakia from imposing localisation on non-personal data except on public-security grounds — which is exactly the ground the gambling and government-cloud rules would have to rest on.

The authority (Úrad na ochranu osobných údajov Slovenskej republiky) is led by chair Zuzana Valková, with deputy chair Tomáš Danč appointed with effect from 24 October 2024. Its own 2025 annual report gives the numbers used above, plus 10 procedural fines, 177 breach notifications received (a 45% year-on-year rise), 59 internal appeals lodged and 66 decided. Its budget for 2025 was about 4.9 million euros. The enforcement profile is unusual: very high volume, very low value. A large share of 2025's caseload came from a wave of anonymous mass complaints that municipalities were publishing insufficiently redacted contracts in the Central Register of Contracts, which the office is legally obliged to examine one by one. It is also active in the European Data Protection Board and has signed up to the Board's 2026 coordinated enforcement action on transparency. Rating actively enforced rather than aggressive: fines are frequent and routine, but the office is small, the amounts are modest by European standards, and there is no evidence of large proactive investigations of major platforms. Other regulators: the National Security Authority (Národný bezpečnostný úrad) supervises cybersecurity under Act 69/2018 Coll. and can fine up to 10 million euros or 2% of turnover; the National Bank of Slovakia supervises financial firms; the Gambling Regulatory Authority supervises the gambling server rule; the Geodesy, Cartography and Cadastre Authority supervises the mapping deposit duties.

THE CEILING. Article 5(1)(e) of the General Data Protection Regulation, applied directly, requires storage limitation: keep personal data in identifiable form no longer than necessary. Act 18/2018 Coll. adds no general Slovak retention ceiling. The data protection authority has treated keeping camera-system recordings for longer than 72 hours as a point of concern in its supervision. THE FLOOR. Accounting: section 35 of Act 431/2002 Coll. requires financial statements, the annual report, accounting records, inventory lists and the chart of accounts to be kept for ten years following the year they relate to; audit reports likewise ten years; sustainability reporting five years. Before a company is wound up it must tell the tax office who will hold the accounting documentation. Health: the annexes to Act 153/2013 Coll. set retention for the national health registers at up to one hundred years after the death of the person, and five years after a contact person's role ends. Gambling: section 14(22) of Act 30/2019 Coll. requires the Slovak-based server to record all games, stakes, winnings, software interventions and player-account movements. Mapping: aerial survey imagery must be deposited in a state archive permanently. HOW CONFLICTS RESOLVE. Slovakia does what most European Union states do: a specific statutory keeping duty is a legal obligation under Article 6(1)(c) of the Regulation and beats a deletion request, but only for the data and the period the statute actually names. A ten-year accounting duty does not license keeping an entire customer relationship record for ten years. TELECOMS — the finding most trackers get wrong. On 29 April 2015 the Constitutional Court, in PL. ÚS 10/2014 (published as no. 139/2015 Coll.), held the blanket retention provisions of the old Act 351/2011 Coll., together with the linked Criminal Procedure Code and Police Act powers, incompatible with the Constitution, the Charter of Fundamental Rights and Freedoms and the European Convention. The replacement law, Act 452/2021 Coll., does not restore blanket retention: section 112(2) requires an operator to retain traffic, location and communicating-party data only where those data are covered by a court authorisation, a subsequent court authorisation, or a court order under the Criminal Procedure Code. There is a separate, ordinary rule that traffic data may be kept until the time limit for challenging or enforcing an invoice expires. Anyone still citing a six-month Slovak telecoms retention period is quoting a law that was struck down eleven years ago.

CLOCK ONE — privacy. Article 33 of the General Data Protection Regulation: notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights. Article 34: tell affected individuals without undue delay where the risk is high. The Slovak authority takes notifications through its own form on the national portal, and its 2025 report complains that controllers often bypass the form and file something too brief to assess. It received 177 notifications in 2025. Processors must tell their controller without undue delay. CLOCK TWO — cybersecurity. Act 69/2018 Coll., as amended to transpose the NIS2 Directive by Act 366/2024 Coll. with effect from 1 January 2025 and further amended in 2026, requires an early warning without undue delay and at the latest within 24 hours of detecting a significant incident, then a notification without undue delay and at the latest within 72 hours. There is also a duty to provide information to the authority within 72 hours of a request. Fines run to 10 million euros or 2% of worldwide turnover for essential entities and 7 million euros or 1.4% for important entities. WHERE PEOPLE COME UNSTUCK. The two regimes cover overlapping but different organisations and go to different regulators, and the 24-hour cybersecurity warning fires a full day before the privacy deadline. A ransomware attack on a Slovak hospital or energy supplier triggers both. Financial entities have a third clock under the Digital Operational Resilience Act. Build one incident process that starts the 24-hour clock by default and de-escalates, rather than deciding which regime applies first.

1. PUBLIC BODIES GET NO DISCOUNT. Many European Union states cap or waive fines on public authorities. Slovakia does the opposite and says so in the text: section 104(1)(a) of Act 18/2018 Coll. applies the 10-million-euro or 2%-of-turnover ceiling to a controller 'vrátane orgánu verejnej moci a verejnoprávnym inštitúciám' — including public authorities and public-law institutions — and section 104(1)(c) does the same for public bodies acting as processors. Municipalities and state agencies are squarely in scope, and in 2025 they were the largest single source of complaints. 2. IT IS A CRIME. Section 374 of the Criminal Code (Act 300/2005 Coll.) makes it an offence, punishable by up to one year in prison, to disclose, make available or publish someone else's personal data obtained in connection with public authority, the exercise of constitutional rights, or your own profession, employment or office, in breach of a legal duty. Up to two years where it causes serious harm to the person's rights, is done publicly, or is done in a more serious manner. This attaches to individual employees, not just to the company. 3. AGE SIXTEEN. Section 15(1) of Act 18/2018 Coll. sets the age at which a child can consent to an information society service at 16 — Slovakia did not use the option to lower it to 13. Below 16, a legal representative must give or approve the consent, and the controller must make reasonable efforts to verify that, taking available technology into account. A product built for a United States thirteen-year-old threshold is non-compliant in Slovakia. 4. DEAD PEOPLE'S DATA CHANGED ON 18 AUGUST 2026. Until today, Act 18/2018 Coll. contained a genuinely unusual Slovak rule: where the person had died, a close relative could give the consent the law required, and the consent was invalid if even one close relative objected in writing. Act 168/2026 Coll., in force from 18 August 2026, deletes that mechanism and instead excludes deceased persons from the Act altogether. If your Slovak consent process or genealogy, archive or funeral-sector product relied on the relative-consent rule, it is now built on a repealed provision. This is a day-old change and the plain-language guidance has not caught up. 5. THE GAMBLING SERVER RULE HAS NO EUROPEAN WORKAROUND. Slovakia says 'on the territory of the Slovak Republic', not 'in the European Economic Area'. An operator licensed elsewhere in the Union cannot serve Slovak players from a Dutch or Maltese data centre, and the regulator must be given free online access to that Slovak server. 6. BONUS TRAP — CONTRACT PUBLICATION. Slovak public bodies must publish their contracts in the Central Register of Contracts. That means your commercial agreement with a Slovak ministry or municipality becomes public, and any personal data in it has to be redacted first — a failure the privacy authority is now receiving mass complaints about.

ALREADY HAPPENED, TODAY. Act 168/2026 Coll. amended Act 18/2018 Coll. with effect from 18 August 2026: deceased persons are removed from the Act's scope, the Ministry of Justice is added to the list of competent authorities for law-enforcement processing, and a new rule governs onward transfer of data received from a third country, linked to Act 167/2026 Coll. on international judicial cooperation in criminal matters. BILLS, NOT LAW. On 11 March 2025 the data protection authority announced it was replacing Act 18/2018 Coll. with two separate statutes: a general one, and one dedicated to police and justice processing under Directive (EU) 2016/680. Both went to interministerial consultation as files LP/2025/305 and LP/2025/306 with a comment deadline of 1 July 2025. The stated aims are to end the 'dvojkoľajná úprava' — the two-track system that copies the directly applicable Regulation into national law — to cut the burden of impact assessments, and to introduce codes of conduct and certification supervised by the authority. As at 18 August 2026 the authority's own national legislation page still lists only Act 18/2018 Coll., and no replacement act appears in the collection of laws. A great deal of Slovak commentary published in late 2025 and 2026 announces a 'new data protection act from 2026' as though it were settled. It is not. Treat it as a bill. DATED CHANGES. 1 January 2027: Act 95/2019 Coll., as amended by Act 67/2026 Coll., widens what public bodies must publish into the central metadata system — not just technical details of their systems but metadata about the registers they run, the data those registers hold, and the legal basis on which anyone may use that data, with an express instruction that this must not directly or indirectly disclose personal data. 12 January 2027: the European Data Act's hard deadline, after which all cloud switching charges and data egress fees must be zero. 30 April 2026 has already passed: Act 67/2026 Coll. amended both the cybersecurity act and the public administration IT act on that date. DORMANT SWITCHES — powers already held that could change things without warning. First, the government cloud categories are set by ministerial methodological guidance, not by statute. The ministry can redefine which data falls into category U4 — the tier that must stay in Slovakia — and widen the localisation wall by publishing a new document, without parliament and without consultation. Registrations lapse every two years, so a change bites within one renewal cycle. Second, the gambling regulator's power to demand free online access to the operator's Slovak server is open-ended, with the scope set by finance ministry decree. Third, the cybersecurity authority's powers under Act 69/2018 Coll. include mandatory blocking measures. Fourth, the two replacement privacy bills could be reintroduced and passed quickly, since the drafts already exist and the responsible regulator is their author.