Slovakia

GDPR Articles 33-34, Breach Notification

A controller must notify the Office for Personal Data Protection of the Slovak Republic within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. CMS's commentary states there are no derogations from the General Data Protection Regulation (GDPR) for this dimension in Slovakia; no primary text was read.

Act on the Protection of Personal Data

Slovakia gives the General Data Protection Regulation (GDPR) domestic effect through Act No. 18/2018 Coll. on the Protection of Personal Data, effective 25 May 2018. This session could not read the Act's own text at all: slov-lex.sk, the official legislative portal, served only a JavaScript navigation shell to both a direct fetch and a crawler-based reader, confirmed on repeated attempts across the wave.

Every finding below rests on two commentary sources (CMS's expert guide and DLA Piper's Data Protection Laws of the World) rather than a primary-source read, and should be treated as unconfirmed until someone reads the Act directly.

GDPR Chapter V, Cross-Border Transfer Restrictions

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. DLA Piper's commentary confirms no further Slovak derogation, describing free movement of personal data between Slovakia and other EU member states; no primary text was read.

GDPR Articles 12-22, Data-Subject Rights

General Data Protection Regulation (GDPR) Articles 12-22 apply directly. No Slovak-specific derogation was found in either commentary source consulted, but this was not exhaustively checked article by article and no primary text was read.

Office for Personal Data Protection Enforcement and GDPR Article 82

Urad na ochranu osobnych udajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) is the supervisory authority, confirmed by both commentary sources; fine amounts and detailed procedure were not independently checked beyond the General Data Protection Regulation (GDPR) baseline.

GDPR Article 82 arms an individual with a direct private right of action; DLA Piper states Slovak private rights of action derive from Article 82 without further elaboration, and no Slovak transposition of the EU Representative Actions Directive was found or ruled out in this pass.

GDPR Article 9 and Act Section 78, National Birth Number

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Commentary (CMS) quotes the Act as permitting biometric, genetic, and health data processing on the basis of a special regulation or an international agreement, a general enabling clause rather than a substantive biometric-specific carve-out; no employment-biometric consent or works-council rule was found in either commentary source.

A separate, more specific commentary-sourced finding, Section 78, protects the Slovak birth number (rodne cislo): explicit consent is required to process it, and public disclosure is prohibited unless the data subject discloses it themself. None of this was independently verified against the Act's own text this session.

No commencement date is recorded for this instrument: this document rests entirely on commentary with no primary-source text read, and status is downgraded from in_effect to enacted rather than asserting an unconfirmed effective date.