Processes personal data, in Slovakia

Act No. 18/2018 Coll. on the Protection of Personal Data, section 78(7) · Read the law's page

• When processing personal data for archiving, scientific, historical research or statistical purposes, adopt appropriate safeguards for the data subject's rights, including appropriate and effective technical and organisational measures to ensure data minimisation and pseudonymisation (section 78(7)).
• For further processing of personal data for archiving, scientific, historical research or statistical purposes to count as compatible with the original purpose, act in accordance with a special regulation and observe the safeguards under section 78(7) (section 7).

Regulation (EU) 2016/679, Art. 9; Zakon c. 18/2018 Z. z., section 78 · Read the law's page

• Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, genetic, or health data of a person in Slovakia.
• Use the Slovak birth number (rodne cislo) to identify a person only where that use is necessary for the purpose, obtain explicit consent where consent is the legal basis, and do not publish it unless the data subject published it themself (Act No. 18/2018 Coll., Section 78(4)).

Regulation (EU) 2016/679, Arts. 12-21; Zákon č. 18/2018 Z. z. · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Slovakia within one month of receipt.

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the Slovak Office for Personal Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Slovakia, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Slovakia outside the EEA.

Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page

• Compensate any person in Slovakia who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Zakon c. 18/2018 Z. z. o ochrane osobnych udajov a o zmene a doplneni niektorych zakonov · Read the law's page

• Establish a lawful basis under Section 13(1) of the Act and GDPR Article 6 before processing personal data of a person in Slovakia.

Zákon č. 242/2026 Z. z. o zodpovednosti za škodu spôsobenú vadným výrobkom · Read the law's page

• This Act is enacted but does not apply yet: it applies to damage caused by a product placed on the market or put into service from 9 December 2026, and Act No. 294/1999 Z. z. keeps governing earlier products (Secs. 17, 19 and 20).
• If you develop, make or produce a product, software included, have it designed or made, or present yourself as its manufacturer by your name, trade mark or other distinguishing sign, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the Act (Secs. 1(2)(a), 2(a) and (f), 6(1)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is under your control: a defect caused by software, an update or upgrade, a missing necessary update, a related service or a substantial modification under your control is not excused on the ground that it arose after you placed the product on the market (Secs. 2(g), 7(1)(c) and 7(4)).
• Treat safety-relevant cybersecurity requirements and any recall or other corrective measure as part of what decides whether your product is defective (Sec. 5(2)(f) and (g)).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Sec. 5(2)(c)).
• Keep evidence you could produce if a court orders you to disclose it on a claimant's plausible claim: failing to disclose presumes the product defective (Secs. 14(1) and 15(2)(a)).
• Meet the binding product-safety requirements that protect against the harm: failing them presumes the product defective (Sec. 15(2)(b)).
• If you are a manufacturer outside the EU or the EEA, your importer, your authorized representative and, failing both, the logistics service provider answer in addition to you (Sec. 6(3)).
• If you distribute a product or run an online platform that lets consumers contract with traders, identify the liable person established in a Member State, or your own supplier, within one month of the injured person's request, or you answer for the damage (Sec. 6(4) and (5)).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into service, you answer as a liable person (Sec. 6(6)).
• If you made only a component, be ready to prove that the design of the product it was incorporated into, or the product manufacturer's instructions, caused the defect (Secs. 6(2) and 7(2)).
• Do not rely on a contract term or a unilateral declaration to exclude or limit your liability to the injured person, because it is void (Sec. 8).
• Keep the claim periods in view: three years from when the injured person learned or could have learned of the damage, the defect and your identity, and ten years from when you placed the product on the market or put it into service, or 25 years for a delayed injury to health (Secs. 12 and 13).