🇸🇻Personal Data Protection Law, Legislative Decree 144
Personal Data Protection Law — Decree 144
The law applies principles of legality, fairness, consent and purpose, minimisation, transparency, security, temporality and accountability to public and private processing.
Core duties
Every regulated subject must appoint a data-protection delegate. Controllers must provide the Article 24 notice, prove valid consent where relied upon, apply enhanced rules to sensitive and children's data, and document procedures for access, rectification, cancellation, objection, portability, opposition and limitation.
Rights decisions are generally due within 20 business days, subject to one justified extension of up to 20 business days. A qualifying incident triggers notification to the cybersecurity authority, the Attorney General and affected people within 72 hours of awareness, together with review and incident records.