Slovakia

Two sets of rules stack up. The European General Data Protection Regulation applies directly in Slovakia. Its Article 3(2) reaches companies outside the European Union that offer goods or services to people in the Union, or that watch their behaviour. Article 27 then makes you name a written representative in a member state where those people are. On top of that, section 3(4) of Act 18/2018 Coll. sets Slovakia's own reach. Point (a) catches any company with a registered office, place of business, branch, establishment or permanent home in Slovakia. It applies whether you use the data inside or outside the territory of the Slovak Republic. That wording is the clearest sign in the text that Slovak law does not care where your servers are. Point (c) catches the handling of data about people in Slovakia by a company based outside the member states. There is no Slovak registration or licence to get before you may use personal data. The old notification duty went with the 1998 and 2013 Acts. If you appoint a data protection officer, you must tell the authority, using its own form. Act 18/2018 Coll. is on its way out. The authority has two replacement bills moving through the law-making process. See question eight. On 18 August 2026 they are still only bills.

Industry by industry, all checked 18 August 2026. GAMBLING - data must stay in Slovakia. Section 14(22) of Act 30/2019 Coll. on gambling says the gambling operator must place the server on Slovak territory. The same section makes the server record every game played, and every stake and win. It must also record every change to the game software. For online games it must record every movement in a player's account. Section 14(21) makes the operator give the gambling regulator free online access to that server. This is stricter than Hungary's version, which allows anywhere in the European Economic Area. Rating: data must stay in the country GOVERNMENT - data must stay in Slovakia, but only at the top tier. Section 24a of Act 95/2019 Coll. lets the ministry set standards. Those standards can force public bodies deciding on people's rights and duties to use only cloud services listed in the government cloud catalogue. The binding guidance of 11 April 2025 (ref. 020775/2025/oSBATA, in force from 15 April 2025) sets four categories. Category U4, 'special data', must be stored and used on Slovak territory. It must sit in a data centre within reach of Slovak state authorities, in the private part of the government cloud. Categories U1 to U3 carry no location requirement. But the questionnaire still demands a full list of data centre locations. It flags this as important where personal data would sit outside the European Union. Only the Ministry of the Interior, with the Ministry of Finance data centre, may supply the private infrastructure and platform layers. Registration lasts two years and lapses automatically if you do not renew it. Rating: data must stay in the country for U4, data can leave only if conditions are met below it. MAPPING AND AERIAL IMAGES - a copy must stay. Section 8 of Act 215/1995 Coll. on geodesy and cartography covers anyone who acquires original aerial remote-sensing material or aerial survey photographs. You must report it within 30 days. After you have used it, you must hand it over free of charge to a special archive run by the Ministry of Defence. If you publish maps, you must give the archive of the Geodesy, Cartography and Cadastre Authority two paper copies within 30 days. Add one digital copy if a digital version exists. You must also give one more copy to the Ministry of Defence archive. You keep your own copy and may take it abroad. So this is a copy duty, not a ban on exporting. Rating: a copy must stay in the country BANKING, PAYMENTS, INSURANCE, SECURITIES - we found no rule that data must stay in Slovakia. The central bank's own cloud computing page tells firms that using a public cloud does not remove their responsibility for confidentiality, integrity and availability. It points them to the European Banking Authority outsourcing recommendations. It states no location rule. Its insurance outsourcing page says only critical or important operational functions need advance notice, under section 30(3) of the Insurance Act. It expressly allows providers in other member states or outside Europe that meet Article 274 of Delegated Regulation 2015/35. The Digital Operational Resilience Act has applied to financial firms since 17 January 2025. It makes you name in the contract where the data is handled, with audit rights and an exit plan. That is disclosure, not a rule about location. Rating: data can leave only if conditions are met HEALTH - we found no rule that data must stay in Slovakia. Act 153/2013 Coll. on the national health information system has no rule about location. The national system itself is run by the state and physically in Slovakia. That is a fact about a state system, not a rule binding private companies. What the act does contain is very long keeping times. See question five. TELECOMS - we found no rule that data must stay in Slovakia. Telecoms companies also keep much less data than most people assume. See question five. EDUCATION, ONLINE SHOPPING, SOCIAL MEDIA, ARTIFICIAL INTELLIGENCE - we found no Slovak storage-location rule, checked 18 August 2026. DEFENCE AND CLASSIFIED MATERIAL - we did not research this in depth. Classified information has its own separate law, Act 215/2004 Coll., which we did not check. This record does not cover anything classified.

Section 48 of Act 18/2018 Coll. copies Chapter V of the European General Data Protection Regulation. There are three routes, in order. First, the European Commission has decided the destination country is safe enough. If not, second, you use approved safeguards. If not, third, you rely on one of a few narrow exceptions. The Slovak authority runs the forms for notifying and approving transfers outside Europe, for approving contract clauses, and for approving company-wide rules. It lists them on its own site. The 2021 standard contract clauses (Decision (EU) 2021/914) are still the ones to use and have not been changed. New clauses were promised for receivers already covered by the Regulation under Article 3(2). They are still not adopted as at 18 August 2026. You are also expected to write down a risk check on the destination country, following the Schrems II ruling. The EU-US Data Privacy Framework is still in force and legally valid on 18 August 2026. It is under pressure. The General Court dismissed the Latombe challenge on 3 September 2025. An appeal to the Court of Justice was lodged on 31 October 2025 and is still pending. On 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether changes in United States institutions affect the decision. The Commission has not suspended or revoked it. Our advice: you can use it, but never as your only route. Separately, European Data Protection Board Guidelines 02/2024 confirm one point. An order from a foreign authority is not on its own a legal reason to hand data over. Regulation (EU) 2018/1807 stops Slovakia forcing non-personal data to stay in the country, unless public security requires it. That is the only ground the gambling and government cloud rules could rest on.

The authority (Úrad na ochranu osobných údajov Slovenskej republiky) is led by chair Zuzana Valková. Tomáš Danč became deputy chair with effect from 24 October 2024. Its own 2025 annual report gives the numbers used above. It adds 10 procedural fines, 177 breach reports received (a 45% rise on the year before), 59 internal appeals lodged and 66 decided. Its 2025 budget was about 4.9 million euros. Its enforcement pattern is unusual: very high volume, very low value. A large share of the 2025 caseload came from a wave of anonymous mass complaints. Those said municipalities were publishing contracts in the Central Register of Contracts without blacking out enough personal data. The office must examine each one by law. It is also active in the European Data Protection Board and has joined the Board's 2026 coordinated enforcement action on transparency. We rate it an active regulator rather than aggressive. Fines are frequent and routine. But the office is small, the amounts are modest by European standards, and we found no large proactive investigations of major platforms. Other regulators. The National Security Authority (Národný bezpečnostný úrad) supervises cybersecurity under Act 69/2018 Coll. and can fine up to 10 million euros or 2% of turnover. The National Bank of Slovakia supervises financial firms. The Gambling Regulatory Authority supervises the gambling server rule. The Geodesy, Cartography and Cadastre Authority supervises the mapping deposit duties.

THE MAXIMUM. Article 5(1)(e) of the European General Data Protection Regulation applies directly. You may not keep personal data in a form that identifies someone for longer than you need it. Act 18/2018 Coll. adds no general Slovak maximum. The data protection authority has treated keeping camera recordings for longer than 72 hours as a point of concern. THE MINIMUM. Accounting: section 35 of Act 431/2002 Coll. covers financial statements, the annual report, accounting records, inventory lists and the chart of accounts. All must be kept for ten years following the year they relate to. Audit reports: ten years as well. Sustainability reporting: five years. Before a company is wound up it must tell the tax office who will hold its accounting papers. Health: the annexes to Act 153/2013 Coll. set keeping times for the national health registers. That is up to one hundred years after the death of the person. Contact-person data is kept for five years after that role ends. Gambling: section 14(22) of Act 30/2019 Coll. makes the Slovak server record all games, stakes, winnings, software changes and player-account movements. Mapping: aerial survey images must be kept in a state archive permanently. WHICH RULE WINS. Slovakia does what most European Union countries do. A specific legal duty to keep something is a legal duty under Article 6(1)(c) of the Regulation, and it beats a deletion request. But it wins only for the data and the period the law actually names. A ten-year accounting duty does not let you keep a whole customer record for ten years. TELECOMS. On 29 April 2015 the Constitutional Court, in PL. ÚS 10/2014 (published as no. 139/2015 Coll.), struck down the blanket keeping rules in the old Act 351/2011 Coll. It struck down the linked powers in the Criminal Procedure Code and the Police Act too. It found them incompatible with the Constitution, the Charter of Fundamental Rights and Freedoms and the European Convention. The replacement law, Act 452/2021 Coll., does not bring blanket keeping back. Its section 112(2) is much narrower. An operator keeps traffic, location and communicating-party data only where a court authorisation covers it. A later court authorisation or a court order under the Criminal Procedure Code also counts. There is a separate ordinary rule that traffic data may be kept until the time limit for challenging or enforcing an invoice runs out. Anyone still citing a six-month Slovak telecoms keeping period is quoting a law that was struck down eleven years ago.

DEADLINE ONE - privacy. Article 33 of the European General Data Protection Regulation covers this. Tell the supervisory authority as soon as you can, and within 72 hours of finding out where possible. You can skip this if the breach is unlikely to put people's rights at risk. Article 34: tell the affected people as soon as you can where the risk is high. The Slovak authority takes reports through its own form on the national portal. Its 2025 report complains that companies often bypass the form and file something too brief to assess. It received 177 reports in 2025. If you handle data for another company, tell that company as soon as you can. DEADLINE TWO - cybersecurity. Act 69/2018 Coll. brought in the NIS2 Directive through Act 366/2024 Coll., with effect from 1 January 2025, and was amended again in 2026. You must send an early warning as soon as you can and within 24 hours of detecting a significant incident. Then a fuller report as soon as you can and within 72 hours. You must also answer a request for information from the authority within 72 hours. Fines reach 10 million euros or 2% of worldwide turnover for essential organisations, and 7 million euros or 1.4% for important ones. WHERE PEOPLE GET CAUGHT OUT. The two sets of rules cover overlapping but different organisations, and they go to different regulators. The 24-hour cybersecurity warning falls a full day before the privacy deadline. A ransomware attack on a Slovak hospital or energy supplier triggers both. Financial firms have a third deadline under the Digital Operational Resilience Act. Build one incident process that starts the 24-hour clock by default. Then step down if it turns out you do not need it.

1. PUBLIC BODIES GET NO DISCOUNT. Many European Union countries cap or waive fines on public authorities. Slovakia does the opposite and says so in the text. Section 104(1)(a) of Act 18/2018 Coll. applies the ceiling of 10 million euros or 2% of turnover to public authorities and public-law institutions too. Section 104(1)(c) does the same for public bodies that handle data on behalf of someone else. Municipalities and state agencies are squarely covered. In 2025 they were the single largest source of complaints. 2. IT IS A CRIME. Section 374 of the Criminal Code (Act 300/2005 Coll.) makes one thing a crime. That is disclosing, sharing or publishing someone else's personal data in breach of a legal duty. It applies where you got the data through public authority, through the exercise of constitutional rights, or through your own profession, employment or office. The penalty is up to one year in prison. It rises to two years where it seriously harms the person's rights, is done publicly, or is done in a more serious manner. This attaches to individual employees, not just to the company. 3. AGE SIXTEEN. Section 15(1) of Act 18/2018 Coll. sets the age at which a child can agree to an online service at 16. Slovakia did not use the option to lower it to 13. Below 16, a legal representative must give or approve the consent. You must make reasonable efforts to check that, using the technology available. A product built for the United States age of 13 breaks Slovak law. 4. DEAD PEOPLE'S DATA CHANGED ON 18 AUGUST 2026. Until today, Act 18/2018 Coll. had an unusual Slovak rule. Where the person had died, a close relative could give the consent the law required. That consent was invalid if even one close relative objected in writing. Act 168/2026 Coll., in force from 18 August 2026, deletes that mechanism. It now leaves dead people out of the Act altogether. If your Slovak consent process relied on the relative-consent rule, it is now built on a rule that no longer exists. The same goes for genealogy, archive and funeral products. This change is one day old and the plain-language guidance has not caught up. 5. NO EUROPEAN WORKAROUND FOR THE GAMBLING SERVER. Slovakia says 'on the territory of the Slovak Republic', not 'in the European Economic Area'. An operator licensed elsewhere in the Union cannot serve Slovak players from a Dutch or Maltese data centre. The regulator must also be given free online access to that Slovak server. 6. ONE MORE - CONTRACT PUBLICATION. Slovak public bodies must publish their contracts in the Central Register of Contracts. So your commercial agreement with a Slovak ministry or municipality becomes public. Any personal data in it has to be blacked out first. The privacy authority is now receiving mass complaints about failures to do that.

ALREADY HAPPENED, TODAY. Act 168/2026 Coll. amended Act 18/2018 Coll. with effect from 18 August 2026. Dead people are removed from the Act's scope. The Ministry of Justice is added to the list of authorities that may handle data for law enforcement. A new rule covers passing on data received from a country outside Europe. It is linked to Act 167/2026 Coll. on international judicial cooperation in criminal matters. BILLS, NOT LAW. On 11 March 2025 the data protection authority announced it was replacing Act 18/2018 Coll. with two separate statutes. One would be general. One would cover police and justice work under Directive (EU) 2016/680. Both went to consultation between ministries as files LP/2025/305 and LP/2025/306, with comments due by 1 July 2025. There are three stated aims. End the two-track system that copies the directly applicable Regulation into national law. Cut the burden of impact assessments. Bring in codes of conduct and certification supervised by the authority. As at 18 August 2026 the authority's own national legislation page still lists only Act 18/2018 Coll. No replacement act appears in the collection of laws. A great deal of Slovak commentary from late 2025 and 2026 announces a 'new data protection act from 2026' as though it were settled. It is not. Treat it as a bill. DATED CHANGES. 1 January 2027: Act 95/2019 Coll., as amended by Act 67/2026 Coll., widens what public bodies must publish into the central metadata system. That now covers more than technical details of their systems. It also covers the registers they run, the data those registers hold, and the legal basis for using that data. It expressly says this must not reveal personal data, directly or indirectly. 12 January 2027: the European Data Act's firmest deadline. From then, all cloud switching charges and data export fees must be zero. 30 April 2026 has already passed. Act 67/2026 Coll. amended both the cybersecurity act and the public administration IT act on that date. POWERS THAT COULD CHANGE THINGS WITHOUT WARNING. First, the government cloud categories are set by ministry guidance, not by a law passed in parliament. The ministry can redefine what falls into category U4, the tier that must stay in Slovakia. It can do that by publishing a new document, without parliament and without consultation. Registrations lapse every two years, so a change would take effect within one renewal cycle. Second, the gambling regulator's power to demand free online access to the operator's Slovak server is open-ended. The Ministry of Finance sets its scope by decree. Third, the cybersecurity authority's powers under Act 69/2018 Coll. include ordering blocking measures. Fourth, the two replacement privacy bills could be brought back and passed quickly. The drafts already exist and the responsible regulator wrote them.