Slovenia. Comprehensive data protection. Act
ZVOP-2Personal Data Protection Act (Zakon o varstvu osebnih podatkov – ZVOP-2)
In force
§1Summary
- Synopsis
ZVOP-2 brought Slovenia's GDPR implementation into force in 2023 after years of delay. It covers video surveillance, biometrics, research, deceased persons and processing logs.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 15. Mandatory processing logs for large-scale special-category processing and systematic monitoring (2-year retention); protection of deceased persons' data for 20 years; detailed CCTV rules with national fines.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; national fines €200–€40,000
§3Dates
- Key dates
- Adopted
- In force
- Uradni list RS 163/2022; replaced ZVOP-1 (2004); processing logs for existing systems by 2025-01-26
§4Text and authority
- Text
- Authoritative text uradni-list.si
- Authority
- Informacijski pooblaščenec (Information Commissioner, IP RS)
§5Where it applies
- Domestic law of
- Slovenia
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Some secondary sources still state 16; ZVOP-2 sets 15.