🇸🇮Personal Data Protection Act (ZVOP-2)

← Back to laws in Slovenia

Personal Data Protection Act (ZVOP-2)

Slovenia applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

ZVOP-2 supplements the GDPR in Slovenia and adds detailed national rules for children, deceased persons, logging, designated high-risk systems, research, surveillance, biometrics, workplace access records and public-register connections.

National additions and variations

• Article 8 sets 15 as the age for consent-based information-society services and bars excessive data requirements as a condition of a child's consent.
• Article 22 requires processing logs for specified high-risk automated processing, defines mandatory log fields and generally requires retention for two years after the end of the recording year.
• Articles 23 and 24 impose additional information-security, location, DPIA and prior-consultation duties on defined special processing, including statutory processing of more than 100,000 people or special-category data of more than 10,000 people.
• Articles 76-80 require written surveillance decisions, detailed notices, access-use logs and context-specific retention; the general ceiling is one year, with shorter periods for public transport and public areas.
• Articles 81-84 tightly regulate public- and private-sector biometrics, require prior Information Commissioner approval for most private-sector deployments and prohibit obtaining biometrics in exchange for marketing-related services.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.