Provides telecom services, in Slovakia

§ 54 ods. 6 písm. b) zákona č. 452/2021 Z. z. o elektronických komunikáciách · Read the law's page

• If the Office has assigned you the number 116000 on your application, ensure that the services provided through the number are available to end-users with disabilities in line with the relevant technical standards, including when such an end-user travels outside the Member State in which he or she resides (s. 54(6)(b); Directive (EU) 2018/1972, Art. 96(2)).

§ 82 ods. 4 a 5 zákona č. 452/2021 Z. z. o elektronických komunikáciách · Read the law's page

• If you provide a publicly available service within the Electronic Communications Act, give end-users with disabilities access to services equivalent to those that most end-users use, including the information in your contracts under section 84 (s. 82(4); Directive (EU) 2018/1972, Art. 111(1)(a)).
• The details of equivalent access and of the choice of undertakings and services available to most end-users are left to a regulation of the Office under section 82(5); Decree 345/2025, made under that provision, sets the accessibility requirements for the services of section 83a (s. 82(5); Directive (EU) 2018/1972, Art. 111(1)(b)).

§ 83 ods. 1 písm. b) bod 6 a ods. 2, § 84 ods. 3 a 7, § 85 ods. 1 písm. b) a príloha č. 3 časť B písm. f) zákona č. 452/2021 Z. z. o elektronických komunikáciách · Read the law's page

• If you provide internet access or publicly available interpersonal communications services on contractual terms, publish and keep up to date the details of the products and services, with their functions, practices, policies, procedures and adaptations, that are designed for end-users with disabilities, in line with the special regulation that harmonizes accessibility requirements (s. 83(1)(b) point 6; Directive (EU) 2018/1972, Art. 103(1) and Annex IX point 2.6).
• Publish that information in an understandable, easily accessible and machine-readable form and in a format accessible to all end-users, including end-users with disabilities, in your business premises and, where you have a website, on it through a direct link from its title page (s. 83(2); Directive (EU) 2018/1972, Art. 103(1)).
• Give the consumer the pre-contract information of section 84(3) and Annex 3, including for internet access and interpersonal communications services the details of the products and services intended for end-users with disabilities and how to obtain current information on them, give it also to a prospective customer that is a microenterprise, small enterprise or not-for-profit organization unless it has expressly agreed to go without it, and give it in a format accessible to end-users with disabilities on the request of the consumer or end-user (ss. 84(3), 84(4) and 84(7), Annex 3 Part B point (f); Directive (EU) 2018/1972, Art. 102(1) and (2) and Annex VIII).
• If you provide internet access or publicly available interpersonal communications services, publish up-to-date information for end-users on the measures taken to ensure equal access of end-users with disabilities to the services, in line with the regulation the Office issues under section 85(5) (s. 85(1)(b) and (5)(c); Directive (EU) 2018/1972, Art. 104(1)).

§ 86 ods. 3 písm. e) a § 93 ods. 2, 3 a 6 zákona č. 452/2021 Z. z. o elektronických komunikáciách · Read the law's page

• If you provide a publicly available number-based interpersonal communications service through which end-users can call numbers of the national or international numbering plan, ensure for end-users with disabilities access to rescue services by emergency communication equivalent to that other end-users have (ss. 93(2), 93(3) and 86(3)(e); Directive (EU) 2018/1972, Art. 109(5)).
• Inform the public of the existence and conditions of use of emergency communication, the emergency numbers including 112 and the forms of its availability, including through information for end-users with disabilities, published on your website in an understandable, easily accessible and machine-readable form and for end-users with disabilities in an accessible format suited to different kinds of disability (s. 93(6); Directive (EU) 2018/1972, Art. 109(7)).

§ 96 ods. 2 písm. c), § 97 ods. 2 až 4 a § 98 ods. 5 zákona č. 452/2021 Z. z. o elektronických komunikáciách · Read the law's page

• If the Office has imposed on you by decision the duty to provide the universal service, provide the services of section 96(2)(c) to consumers with disabilities: the conditions that secure them the same availability of the fixed-location connection, voice communications and broadband internet access services as other consumers, in particular suitable terminal equipment, special equipment and special services, and where necessary total conversation or conversion services at an affordable price, as the decision sets (ss. 96(2)(c) and 98(5); Directive (EU) 2018/1972, Art. 85(4)).
• Where the Office requires it under section 98(5), rent or sell, on the request of a consumer with a disability, one specially equipped terminal suited to the disability at the price of a standard telecommunications terminal (s. 98(5)).
• If the Office has obliged you by decision to charge special prices, provide the services of section 96(2) and charge the special price only to a person who proves that he or she is a consumer with low income or special social needs, and conclude a contract with such a consumer on request (s. 97(3) and (4); Directive (EU) 2018/1972, Art. 85(2)).

Vyhláška Národného bezpečnostného úradu č. 493/2022 Z. z. o audite kybernetickej bezpečnosti (19. decembra 2022), v znení vyhlášky č. 212/2026 Z. z. · Read the law's page

• If you are an essential service operator under Act 69/2018 on cyber security, have a certified cyber security auditor audit your security measures, and finish each audit by the end of the third calendar year after the year your last audit ended, or by the end of the fifth calendar year if you do not run a critical basic service and carry out the self-assessment under Section 29(8) of the Act every two years (Annex 2, Part B(1)).
• Have an audit carried out at each significant change, at the latest within six months after the change has a significant effect on your security measures, and do not let one audit run longer than 12 consecutive months (Annex 2, Part B(2) and Section 2(5)).
• When you request an audit, give at least the particulars Annex 1 lists, among them whether you run a critical basic service, the number of your employees and of your suppliers, and the number of your information systems classed as ICT or OT (Annex 1).
• If you carry out the self-assessment, do it every two years, have your cyber security manager answer for its report, and submit the report to the Authority through the unified cyber security information system by the end of the calendar year in which you carried it out (Section 1(2), Section 2(7) and Annex 2, Part B(3)).
• If you began an audit and had not finished it by 31 August 2026, finish it under the rules that applied before 1 September 2026; an audit you begin by 31 December 2026 may also follow those rules (Section 3a).

Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., §§ 17 až 20 · Read the law's page

• Unless you are a digital provider that Section 2(2) names, whose security measures follow Commission Implementing Regulation (EU) 2024/2690 (Section 19(1)), within 12 months of your registration as an essential-service operator, and graded by your own risk analysis, adopt, maintain and carry out general security measures covering at minimum: information- and cyber-security governance; vulnerability and threat management; asset and risk management; incident and event handling; business continuity, backup and disaster recovery; secure acquisition, development and configuration of your networks, systems and applications; compliance assessment and control; cryptography; human-resources security; identity and access management; network-operations security; protection against malicious code and unwanted content; system, network and communications security; event monitoring, logging and reporting; physical and endpoint security; records, privacy and information-labelling protection; supply-chain security; and procurement and use of certified ICT products, services and processes.
• Build and implement an effective mechanism for promptly informing your statutory body and responsible senior employees of cyber threats, vulnerabilities, incidents, near-misses, their possible impact, and the status of your risk treatment.
• Where you also operate a service the Act designates a "critical basic service" (the functions of a central state-administration body; a large enterprise, above the medium-enterprise threshold, active in an Annex 1 sector other than public administration; a qualified trust service, TLD registry or DNS service; an at-least-medium-sized public electronic communications network or service; a size-independent position under Section 17(1)(c) points 5 to 9, such as sole provider of a key service or a service whose disruption could significantly affect public order, safety or public health; the provision of an essential service to a critical entity; or an information activity or electronic service using public-administration IT that the Authority designates), report that status to the Authority and expect a higher administrative-fine ceiling for the same duties.
• Notify the Authority within 60 days of the day you start an activity that Section 17(1) lists, giving your name, seat and contact data (including email addresses, public IP addresses and telephone numbers), the EU Member States in which you operate or provide the service, and your representative's name, seat and contact data; the Authority makes the register entry and informs you through its information system, and your duties as an operator begin on the day the entry notice names, no earlier than the 30th day after the entry (Section 17(2), (4) and (5)). Report any later change in the registered facts, other than a reference datum, through that system within 14 days (Section 17(6)); Section 19(7) separately gives 30 days for changes in registered data.
• Whatever sector measures apply to you, your security measures must include at least: a cyber security manager who is independent of the management of IT operations and service development and who meets the knowledge standards for the role; incident detection and an incident log; incident-handling procedures; a contact person for receiving and recording reports; a connection to the incident reporting and resolution system and the central early-warning system; assigned roles and responsibilities with training for each role; named persons responsible for approving the measures, oversight, control, audit, adequate resources and training; and security awareness training (Section 19(1) and Section 20(4)).
• Include in your risk analysis the political risk of each third party, assessed in particular against its compliance with the international commitments of Slovakia, the possibility that a state outside the EU and NATO influences it, its ownership and management structure including any foreign-state holding and foreign direct investment, that state's law and international commitments on human rights, cybersecurity, cybercrime, data protection and information protection, and information on that state and intelligence-service information on cyber threats; the Government approves the political risks on the Authority's opinion and the Authority publishes them in its information system (Section 20(5)).
• Have a certified cyber security auditor audit your security measures and your compliance with the Act within two years of your entry in the register, again after every change that significantly affects the measures and at the interval the Authority sets, and file the final audit report, with corrective measures and their deadlines, with the Authority within 30 days of the end of the audit (Section 29(1) to (5)). An operator that does not run a critical basic service may meet the first audit duty by self-assessment in the Authority's information system, carried out by its cyber security manager, but must be audited within five years of its entry in the register (Section 29(8)); an operator that Regulation (EU) 2022/2554 covers has the effectiveness of its measures verified under that Regulation by a certified auditor (Section 29(9)).
• Where a third party carries out an activity that directly bears on the availability, confidentiality or integrity of your networks and information systems, conclude a contract binding it to the security measures and notification duties of the Act for as long as it performs the activity, and carry out a risk analysis when you conclude it; no contract is needed where the third party is itself an operator or the risk is low, and you must tell the third party, to the extent necessary, of a reported incident that would otherwise make performance impossible (Section 19(2) to (4)). The third party must carry out the measures the contract sets and submit to your checks, and where you run a critical basic service the Authority may inspect it too and it is treated as an operator for that purpose; such an operator must also report to the Authority a contract with a third party that has significant influence over its cybersecurity, and the contract's termination (Section 19(2) and (7)); a third party with significant influence over cybersecurity that is under contract to a critical-service operator is itself entered in the register (Section 17(1)(i)).
• Also resolve any cyber security incident; cooperate with the Authority and the central body on a reported incident, giving them the help and information you hold; during an incident secure evidence so that it can be used in criminal proceedings; report to the law-enforcement authority or the Police a crime that an incident involves once you credibly learn of it; analyze the dependencies of your assets, information systems, ICT products and third-party ICT services in the supply chain to identify the impact of an incident; take account of the Authority's security methodologies and policies, current security trends, good practice and international standards; and notify the Authority of the appointment or change of your statutory body when that change is not a reference datum (Section 19(6)(a), (c) to (g) and (i)).
• If a person provides a Section 2(2) service or performs such an activity in Slovakia (or is a third party doing so) and has no residence, place of business or seat in an EU Member State, it must designate a representative who has one in Slovakia or in another Member State where it also provides the service, and keep one throughout (Section 21(1)); any person within Section 2(2) that the Act covers must, on the Authority's request, report in writing through its information system, within three months of the change, any change to its name, annex classification, establishment addresses, its representative's address or contact data, its own contact data, the Member States where it provides the service, or the IP address ranges it uses (Section 21(3)).
• If you run a top-level domain registry or provide domain-name registration, keep a separate register of registration data (the domain name, the registration date, the holder's name and contact data, and the applicant's contact data where different), adopt internal rules and procedures to verify the data submitted at registration, publish the non-personal registration data free of charge immediately after registration, give the Authority or the central body access to the data free of charge within 72 hours of a request, publish your internal rules and the procedure for giving data on your website, and share with the other registry or registrar the data needed so that an applicant need not supply it twice (Section 22(1) to (8)).
• Do not use a product, process, service or third party that the Authority has banned or restricted by a decision published in the Collection of Laws (a ban or restriction lasts up to two years per decision and may be repeated); for use begun before publication, stop or restrict it within the period the decision sets, which is not less than two years and not more than five, and within six months of publication apply appropriate risk-management measures (Section 27a(1), (4) to (7)).
• If you were an operator of an essential service under the Act as it stood until 31 December 2024, you are treated as an operator of a critical basic service unless the Authority decides by 31 December 2026 that you do not meet Section 18(1); a digital service provider under that earlier text is treated as an essential-service operator unless the Authority decides by that date that it does not meet Section 17(1). Until 31 December 2026 you may also adopt and carry out security measures, and run an audit, under the rules in force until 31 December 2024 (Section 34b(1) to (5) and (7)).
• This binds a prevádzkovateľ základnej služby (essential-service operator) entered in the Authority's register under Section 17, whose designation follows the sector annexes: a person meeting at least the medium-enterprise size threshold in an Annex 1 or Annex 2 sector is entered (Section 17(1)(e)), as is, whatever its size, a DNS service provider, a domain-name registration service provider and a person in one of the other positions Section 17(1)(c) lists. A digital provider that Section 2(2) names (a DNS service, a domain-name registration service, a cloud computing service, a data-centre service, a content delivery network, a managed service, a security service, an online marketplace, an online search engine, or a social-networking-services platform) is reached even without a seat in Slovakia where it takes most of its risk-management decisions in Slovakia (or carries out its cybersecurity measures, or has its largest EU establishment, there) or, if established outside the EU, has its Section 21(1) representative in Slovakia or none in any Member State, but a provider other than a DNS or domain-name registration provider is entered only on meeting the medium-enterprise test or another ground in Section 17(1). The wider sector classes (energy, transport, health, water, digital infrastructure, public administration and the other Annex 1 and Annex 2 sectors) are reached by the same designation. The Act does not apply to the banking, financial and financial-system network and information-security requirements that a special regulation sets (Regulation (EU) 2022/2554 and standards of the European Central Bank, the European System of Central Banks, the Eurosystem or the European supervisory authorities), nor to payment and securities clearing and settlement systems that the European Central Bank or the Eurosystem oversees or operates (Section 2(3)(d)).

§ 83a zákona č. 452/2021 Z. z. o elektronických komunikáciách v znení zákona č. 351/2022 Z. z. · Read the law's page

• If you provide a publicly available service within the Electronic Communications Act (internet access, interpersonal communications or signal-transmission services), provide it in line with the accessibility requirements the Office sets by regulation, and keep it in line for as long as you provide it, including when the requirements, the harmonized standards or technical specifications you rely on, or the nature of the service change (s. 83a(1) and (2)(a); Directive (EU) 2019/882, Art. 13(1) and (3)).
• Give information on the conformity of the service with the accessibility requirements in written and oral form, also in a way accessible to persons with disabilities, throughout the offer and provision of the service, and keep that information for as long as you provide the service (s. 83a(2)(b) and (c); Directive (EU) 2019/882, Art. 13(2)).
• Tell the Office without delay that the service has stopped meeting the accessibility requirements, and on its reasoned request give it in the state language all information and documents needed to show conformity (s. 83a(2)(d) and (e); Directive (EU) 2019/882, Art. 13(4) and (5)).
• If you rely on the disproportionate-burden defense, analyze whether its conditions are met, keep the analysis and its documents for five years from the last provision of the service, give them to the Office on request in the period it sets, and repeat the analysis once every five years, when the service changes or when the Office asks (s. 83a(7) and (8); Directive (EU) 2019/882, Art. 14(3) and (5)).
• A service provided in line with the harmonized standards published in the Official Journal of the European Union, or with the technical specifications, or the parts of them that set accessibility requirements, is taken to meet the requirements (s. 83a(3) and (4); Directive (EU) 2019/882, Art. 15).
• You need not meet the requirements to the extent that doing so would fundamentally alter the basic nature of the service or impose a disproportionate burden under the criteria of Decree 345/2025, and you cannot rely on the burden if you use funds from public sources, or from private sources other than your own, given to improve the accessibility of services for persons with disabilities (s. 83a(5) and (6); Directive (EU) 2019/882, Art. 14(1) and (6)).
• A microenterprise, which section 3(c) defines as a businessperson who employs fewer than ten persons in an employment or similar relationship and whose annual turnover or annual balance sheet total is at most one million euro, and a machine-to-machine communication service, are outside section 83a (s. 83a(9); Directive (EU) 2019/882, Art. 4(5)).

§ 1 ods. 5 a 6, § 3 ods. 5, § 4, § 5 ods. 2 a § 6 ods. 1 vyhlášky Úradu pre reguláciu elektronických komunikácií a poštových služieb č. 65/2025 Z. z., ktorou sa ustanovujú podrobnosti o kvalitatívnych ukazovateľoch služieb · Read the law's page

• If you provide publicly available interpersonal communications services to end-users with disabilities through specially adapted information and communication technology, measure and publish the quality indicators of the Decree: audio bandwidth for voice calls, distinguishable display for real-time text, programmatically adjustable sending and receiving direction for real-time text, cooperation between the device and other devices, responsiveness for real-time text, and resolution, frame rate and voice and image synchronization for real-time video, by the method in Annex 3, which takes each indicator's requirement and test from a chapter of EN 301 549 V3.2.1 (Decree 65/2025 s. 1(5) and (6) and Annex 3; Directive (EU) 2018/1972, Art. 104(1)).
• Publish the information on the quality indicators relevant for end-users with disabilities on your website through one link from the title page, in line with section 14 of Decree 78/2020 on standards for information technologies of public administration and in the form most suitable for the needs of users with different kinds of disability (Decree 65/2025 s. 4(1) and (2); Directive (EU) 2018/1972, Art. 104(1)).
• Publish the information on the quality indicators of Annexes 1 and 2 for all end-users in line with section 14 of Decree 78/2020, through one link from the title page of your website (Decree 65/2025 s. 3(5); Directive (EU) 2018/1972, Art. 104(1)).
• Publish the information on the external factors that affect service quality for all end-users, including end-users with disabilities, through one link from the title page, and where you have several websites link each of them to the title page of the website that carries the information (Decree 65/2025 ss. 5(2) and 6(1)).

Vyhláška Národného bezpečnostného úradu č. 226/2025 Z. z. o podrobnostiach o hláseniach (26. augusta 2025) · Read the law's page

• If you are an essential service operator or another person who reports under Section 24 of Act 69/2018 on cyber security, report a serious cyber security incident with the particulars of Annex 2: your identity and contact data, the time of detection, a description of the incident and its consequences or expected scope, whether unlawful conduct may have caused it, whether it may have cross-border impact and the effect on trust services; the follow-up report adds updated information, the status of resolution and the measures taken.
• When you report a significant cyber threat, a near miss or a vulnerability, give the particulars of Annex 3: the type, description, possible impact and time of discovery of what you report and, for a vulnerability, the ICT product, ICT service or operational technology concerned and its manufacturer or provider where you know it.
• Judge whether an event is a serious disruption of an essential service against the criteria of Annex 1: an outage of more than 30 minutes (critical essential service) or 60 minutes (other essential service), an impairment of more than 60 or 180 minutes, a threat to the availability, authenticity, integrity or confidentiality of data protected under a special regulation, a threat to data or related services that affects more than 25,000 persons, an economic loss above 0.1 percent of gross domestic product, an economic loss or material damage to one user above EUR 250,000, rescue work or distress assistance, injury to more than 100 persons needing medical treatment or the death of at least one person, and an event involving apparent unauthorized access to, or a failure of, a network or information system that could cause those consequences, an event that may significantly disrupt another critical-service operator, or an event that is a significant incident under Article 3 of Commission Implementing Regulation (EU) 2024/2690 or an incident under the Critical Infrastructure Act, Act No. 367/2024 Z. z. (Annex 1, points 1 to 8).

Vyhláška Národného bezpečnostného úradu č. 227/2025 Z. z. o bezpečnostných opatreniach (26. augusta 2025), § 1 až 6 · Read the law's page

• If you are an essential service operator under Act 69/2018 on cyber security, maintain security documentation that contains an approved cyber security strategy, approved security policies, a classification of your information, the category of each network, information system and operational technology, a risk analysis with a list of assets, a documented list of the security measures you have and have not adopted with reasons, and the last final audit report (§ 4).
• Manage risk by identifying assets and risks, analyzing and assessing them, adopting security measures with reasons for any you do not adopt, and reviewing the identified risks at least once a year; have the person named in Section 20(4)(h) of the Act approve the results of the analysis and the proposed measures (§ 5).
• Keep a centrally managed register of your primary and supporting assets, their owners and the persons responsible for identifying and recording them, and keep it current (§ 6).
• Include in risk management a functional impact analysis that assesses the effect on your operations of a crisis scenario that may hit the resources and assets supporting your processes or endanger the continuity of your services, and that sets a recovery time objective and a recovery point objective (§ 5(2)).
• Your contract with a supplier under Section 19(2) of the Act must at least bind the supplier to follow your security policies, record its consent to them, provide for the scope, manner and possibility of your controls and audits at the supplier, and require it to inform you of a cyber security incident and of facts that affect cybersecurity and to help resolve it (§ 7(2)); a contract concluded by 31 August 2025 stays valid only for the term originally agreed and cannot be extended after that date if it does not comply with the security measures of §§ 3 to 7 (§ 8).

Vyhláška Úradu pre reguláciu elektronických komunikácií a poštových služieb č. 345/2025 Z. z., ktorou sa ustanovujú podrobnosti o požiadavkách na prístupnosť služieb pre osoby so zdravotným postihnutím a kritériá na posúdenie neprimeranej záťaže · Read the law's page

• If you provide a publicly available electronic communications service within section 83a, make the terminal equipment that enables persons with disabilities to use the service available, from 1 January 2026 (Decree 345/2025 s. 2(a); Directive (EU) 2019/882, Annex I, Section III(a)).
• Give information on how the service works and, where products are used to provide it, on their link to the service, their accessibility features and their interoperability with assistive devices: through more than one sensory channel, in an understandable way, in ways users can perceive, in text formats that can be turned into alternative assistive formats, in a font of adequate size and shape with sufficient contrast and adjustable spacing, with an alternative presentation of any non-text content, and in electronic form where it is needed to provide the service (Decree 345/2025 s. 2(b); Directive (EU) 2019/882, Annex I, Section III(b)).
• Make the websites and mobile applications through which the service is provided, with the related online applications and services, follow the standards for the accessibility and functionality of websites and applications that footnote 1 to section 2(c) of the Decree takes from section 24(1)(b) and section 31(l) of Act 95/2019, so that they are perceivable, operable, understandable and robust (Decree 345/2025 s. 2(c); Directive (EU) 2019/882, Annex I, Section III(c)).
• Where you offer support services (help desk, telephone information centers, technical support, conversion services, training), have them give information on the accessibility of the service and its compatibility with assistive technologies by accessible modes of communication (Decree 345/2025 s. 2(d); Directive (EU) 2019/882, Annex I, Section III(d)).
• Offer text display in real time alongside voice communication, from 1 April 2026 (Decree 345/2025 s. 3(a) and s. 5; Directive (EU) 2019/882, Annex I, Section IV(a)(i)).
• Where you offer video in addition to voice communication, offer total conversation, so that emergency communication by voice and text, including real-time text, is synchronized with the video (Decree 345/2025 s. 3(b); Directive (EU) 2019/882, Annex I, Section IV(a)(ii) and (iii)).
• When you rely on the disproportionate-burden defense of section 83a(5), assess it against the ratio of the net cost of compliance to your total costs for the service, the estimated costs and benefits for you against the benefit for persons with disabilities, and the ratio of the net cost to your net turnover (Decree 345/2025 s. 4; Directive (EU) 2019/882, Annex VI).

§ 86 ods. 3 písm. d), § 93 ods. 4 a § 131f zákona č. 452/2021 Z. z. o elektronických komunikáciách v znení zákona č. 88/2026 Z. z. · Read the law's page

• Once the Ministry of the Interior has provided the technical solution for answering emergency communication (the Ministry must provide it by 28 June 2027 at the latest), if you provide a publicly available number-based interpersonal communications service through which end-users can call numbers of the national or international numbering plan, provide to end-users of 112, free of charge, emergency calls, eCall, SMS and the answering of emergency communication by synchronized voice and text including real-time text (s. 93(4) and s. 131f; Directive (EU) 2019/882, Annex I Section IV(a)(iii)).
• Where the Ministry of the Interior enables the receipt of video, also provide the use of emergency communication by synchronized voice, text including real-time text, and video as total conversation (s. 93(4); Directive (EU) 2019/882, Annex I Section IV(a)(ii) and (iii)).