Is a securities firm, in Slovakia

Zákon č. 69/2018 Z. z. o kybernetickej bezpečnosti a o zmene a doplní niektorých zákonov, v znení zákona č. 366/2024 Z. z., §§ 17 až 20 · Read the law's page

• Unless you are a digital provider that Section 2(2) names, whose security measures follow Commission Implementing Regulation (EU) 2024/2690 (Section 19(1)), within 12 months of your registration as an essential-service operator, and graded by your own risk analysis, adopt, maintain and carry out general security measures covering at minimum: information- and cyber-security governance; vulnerability and threat management; asset and risk management; incident and event handling; business continuity, backup and disaster recovery; secure acquisition, development and configuration of your networks, systems and applications; compliance assessment and control; cryptography; human-resources security; identity and access management; network-operations security; protection against malicious code and unwanted content; system, network and communications security; event monitoring, logging and reporting; physical and endpoint security; records, privacy and information-labelling protection; supply-chain security; and procurement and use of certified ICT products, services and processes.
• Build and implement an effective mechanism for promptly informing your statutory body and responsible senior employees of cyber threats, vulnerabilities, incidents, near-misses, their possible impact, and the status of your risk treatment.
• Where you also operate a service the Act designates a "critical basic service" (the functions of a central state-administration body; a large enterprise, above the medium-enterprise threshold, active in an Annex 1 sector other than public administration; a qualified trust service, TLD registry or DNS service; an at-least-medium-sized public electronic communications network or service; a size-independent position under Section 17(1)(c) points 5 to 9, such as sole provider of a key service or a service whose disruption could significantly affect public order, safety or public health; the provision of an essential service to a critical entity; or an information activity or electronic service using public-administration IT that the Authority designates), report that status to the Authority and expect a higher administrative-fine ceiling for the same duties.
• Notify the Authority within 60 days of the day you start an activity that Section 17(1) lists, giving your name, seat and contact data (including email addresses, public IP addresses and telephone numbers), the EU Member States in which you operate or provide the service, and your representative's name, seat and contact data; the Authority makes the register entry and informs you through its information system, and your duties as an operator begin on the day the entry notice names, no earlier than the 30th day after the entry (Section 17(2), (4) and (5)). Report any later change in the registered facts, other than a reference datum, through that system within 14 days (Section 17(6)); Section 19(7) separately gives 30 days for changes in registered data.
• Whatever sector measures apply to you, your security measures must include at least: a cyber security manager who is independent of the management of IT operations and service development and who meets the knowledge standards for the role; incident detection and an incident log; incident-handling procedures; a contact person for receiving and recording reports; a connection to the incident reporting and resolution system and the central early-warning system; assigned roles and responsibilities with training for each role; named persons responsible for approving the measures, oversight, control, audit, adequate resources and training; and security awareness training (Section 19(1) and Section 20(4)).
• Include in your risk analysis the political risk of each third party, assessed in particular against its compliance with the international commitments of Slovakia, the possibility that a state outside the EU and NATO influences it, its ownership and management structure including any foreign-state holding and foreign direct investment, that state's law and international commitments on human rights, cybersecurity, cybercrime, data protection and information protection, and information on that state and intelligence-service information on cyber threats; the Government approves the political risks on the Authority's opinion and the Authority publishes them in its information system (Section 20(5)).
• Have a certified cyber security auditor audit your security measures and your compliance with the Act within two years of your entry in the register, again after every change that significantly affects the measures and at the interval the Authority sets, and file the final audit report, with corrective measures and their deadlines, with the Authority within 30 days of the end of the audit (Section 29(1) to (5)). An operator that does not run a critical basic service may meet the first audit duty by self-assessment in the Authority's information system, carried out by its cyber security manager, but must be audited within five years of its entry in the register (Section 29(8)); an operator that Regulation (EU) 2022/2554 covers has the effectiveness of its measures verified under that Regulation by a certified auditor (Section 29(9)).
• Where a third party carries out an activity that directly bears on the availability, confidentiality or integrity of your networks and information systems, conclude a contract binding it to the security measures and notification duties of the Act for as long as it performs the activity, and carry out a risk analysis when you conclude it; no contract is needed where the third party is itself an operator or the risk is low, and you must tell the third party, to the extent necessary, of a reported incident that would otherwise make performance impossible (Section 19(2) to (4)). The third party must carry out the measures the contract sets and submit to your checks, and where you run a critical basic service the Authority may inspect it too and it is treated as an operator for that purpose; such an operator must also report to the Authority a contract with a third party that has significant influence over its cybersecurity, and the contract's termination (Section 19(2) and (7)); a third party with significant influence over cybersecurity that is under contract to a critical-service operator is itself entered in the register (Section 17(1)(i)).
• Also resolve any cyber security incident; cooperate with the Authority and the central body on a reported incident, giving them the help and information you hold; during an incident secure evidence so that it can be used in criminal proceedings; report to the law-enforcement authority or the Police a crime that an incident involves once you credibly learn of it; analyze the dependencies of your assets, information systems, ICT products and third-party ICT services in the supply chain to identify the impact of an incident; take account of the Authority's security methodologies and policies, current security trends, good practice and international standards; and notify the Authority of the appointment or change of your statutory body when that change is not a reference datum (Section 19(6)(a), (c) to (g) and (i)).
• If a person provides a Section 2(2) service or performs such an activity in Slovakia (or is a third party doing so) and has no residence, place of business or seat in an EU Member State, it must designate a representative who has one in Slovakia or in another Member State where it also provides the service, and keep one throughout (Section 21(1)); any person within Section 2(2) that the Act covers must, on the Authority's request, report in writing through its information system, within three months of the change, any change to its name, annex classification, establishment addresses, its representative's address or contact data, its own contact data, the Member States where it provides the service, or the IP address ranges it uses (Section 21(3)).
• If you run a top-level domain registry or provide domain-name registration, keep a separate register of registration data (the domain name, the registration date, the holder's name and contact data, and the applicant's contact data where different), adopt internal rules and procedures to verify the data submitted at registration, publish the non-personal registration data free of charge immediately after registration, give the Authority or the central body access to the data free of charge within 72 hours of a request, publish your internal rules and the procedure for giving data on your website, and share with the other registry or registrar the data needed so that an applicant need not supply it twice (Section 22(1) to (8)).
• Do not use a product, process, service or third party that the Authority has banned or restricted by a decision published in the Collection of Laws (a ban or restriction lasts up to two years per decision and may be repeated); for use begun before publication, stop or restrict it within the period the decision sets, which is not less than two years and not more than five, and within six months of publication apply appropriate risk-management measures (Section 27a(1), (4) to (7)).
• If you were an operator of an essential service under the Act as it stood until 31 December 2024, you are treated as an operator of a critical basic service unless the Authority decides by 31 December 2026 that you do not meet Section 18(1); a digital service provider under that earlier text is treated as an essential-service operator unless the Authority decides by that date that it does not meet Section 17(1). Until 31 December 2026 you may also adopt and carry out security measures, and run an audit, under the rules in force until 31 December 2024 (Section 34b(1) to (5) and (7)).
• This binds a prevádzkovateľ základnej služby (essential-service operator) entered in the Authority's register under Section 17, whose designation follows the sector annexes: a person meeting at least the medium-enterprise size threshold in an Annex 1 or Annex 2 sector is entered (Section 17(1)(e)), as is, whatever its size, a DNS service provider, a domain-name registration service provider and a person in one of the other positions Section 17(1)(c) lists. A digital provider that Section 2(2) names (a DNS service, a domain-name registration service, a cloud computing service, a data-centre service, a content delivery network, a managed service, a security service, an online marketplace, an online search engine, or a social-networking-services platform) is reached even without a seat in Slovakia where it takes most of its risk-management decisions in Slovakia (or carries out its cybersecurity measures, or has its largest EU establishment, there) or, if established outside the EU, has its Section 21(1) representative in Slovakia or none in any Member State, but a provider other than a DNS or domain-name registration provider is entered only on meeting the medium-enterprise test or another ground in Section 17(1). The wider sector classes (energy, transport, health, water, digital infrastructure, public administration and the other Annex 1 and Annex 2 sectors) are reached by the same designation. The Act does not apply to the banking, financial and financial-system network and information-security requirements that a special regulation sets (Regulation (EU) 2022/2554 and standards of the European Central Bank, the European System of Central Banks, the Eurosystem or the European supervisory authorities), nor to payment and securities clearing and settlement systems that the European Central Bank or the Eurosystem oversees or operates (Section 2(3)(d)).

Nariadenie vlády Slovenskej republiky č. 283/2023 Z. z., ktorým sa ustanovujú požiadavky na prístupnosť služieb pre osoby so zdravotným postihnutím, kritériá funkčnosti a kritériá na posúdenie neprimeranej záťaže · Read the law's page

• If you provide a service within section 2(1) of Act 351/2022, make the products you use to provide it accessible under the product accessibility requirements (Annex 1, point (a); Directive (EU) 2019/882, Annex I, Section III, point 1).
• Give information on how the service works and, where products are used in it, on their link to the service, their accessibility features and their interoperability with assistive devices, through more than one sensory channel, in an understandable and perceivable way, in text formats that can be turned into alternative formats, in a suitable font size and type with enough contrast and adjustable spacing, with an alternative presentation of non-text content, and in electronic form where that is needed to provide the service in a perceivable, operable, understandable and robust way (Annex 1, point (b)).
• Make the websites and mobile applications through which you provide the service, including related online applications and mobile services, comply with the standards for accessibility and functionality of websites and applications that Act 95/2019 refers to (section 24(1)(b)), so that they are perceivable, operable, understandable and robust; Decree 78/2020 sets that standard by reference to the Slovak technical standard STN EN 301 549 and, in particular, the rules of levels A and AA of WCAG 2.1 (Annex 1, point (c) and footnote 1; Directive (EU) 2019/882, Annex I, Section III, point 2).
• If you run support services such as a helpdesk, telephone information centre, technical support, relay services or training, give through them information on the accessibility of the service and its compatibility with assistive technologies, by accessible means of communication (Annex 1, point (d)).
• If you provide air, bus, rail or water passenger transport services, give information on the accessibility of the vehicle, the surrounding infrastructure and built environment and the assistance for persons with disabilities, and information on electronic ticketing, real-time travel and additional services such as station staffing, lifts out of order and services temporarily unavailable (Annex 2, part A).
• If you provide urban, suburban or regional transport services, make the self-service terminals you use accessible under the product accessibility requirements (Annex 2, part B).
• If you provide financial services, provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and give information that is understandable at no more than level B2 (intermediate) of the Council of Europe's Common European Framework of Reference for Languages (Annex 2, part C).
• If you provide e-books, provide synchronised text and sound where an e-book has both, keep the digital files from hindering assistive technologies, give access to content, navigation and flexible presentation, allow alternative presentation and interoperability with assistive technologies, make the e-book findable through metadata on accessibility features, and do not let digital rights management measures block accessibility features (Annex 2, part D).
• If you provide information society services, give information on the accessibility of the products and services sold where the responsible economic operator provides it, and make the identification, security and payment functions that are part of the service in place of a product, and the identification methods, electronic signatures and payment services, perceivable, operable, understandable and robust (Annex 2, part E).
• Where the requirements do not cover a function of the service, meet the functional criteria: use without vision, with limited vision, without perception of colour, without hearing, with limited hearing, without vocal capability, with limited manipulation or strength, with limited reach, with limited cognition, and privacy (Annex 3).
• Judge disproportionate burden on the ratio of net costs of compliance to the total costs of providing the service, the estimated costs and benefits to you against the benefit to persons with disabilities given how many times and how often the service is provided, and the ratio of net costs to your net turnover; count one-off organisational costs (extra expert staff, training, a new process, guidance, learning the rules) and ongoing production and development costs (design of accessibility features, production processes, testing, documentation) (Annex 4; Directive (EU) 2019/882, Art. 14 and Annex VI).
• You may keep providing a service until 28 June 2030 with a product that does not meet the product accessibility requirements if you used that product to provide the service before 28 June 2025 in line with the rules governing its use (s. 5; Directive (EU) 2019/882, Art. 32(1)).

§§ 2 až 8, 10 a 12 zákona č. 351/2022 Z. z. o prístupnosti výrobkov a služieb pre osoby so zdravotným postihnutím a o zmene a doplnení niektorých zákonov · Read the law's page

• If you offer to consumers a service listed in section 2(1) of the Act (passenger transport by air, bus, rail or water as to websites, mobile services and applications, electronic tickets and ticketing services, travel information including real-time information and self-service terminals located in Slovakia; financial services; e-books and dedicated software; information society services), make the service meet the accessibility requirements that Government Regulation 283/2023 sets (ss. 2(1) and 4(1); Directive (EU) 2019/882, Arts. 2(2) and 4(1) and (3)).
• Design and provide the service so that those requirements are met, and keep procedures in place so that the service stays in conformity when the service or the requirements change (s. 6(1)(a) and (c); Directive (EU) 2019/882, Art. 13(1) and (3)).
• State in your general terms of service, or a similar document, a general description of the service in accessible formats, the explanations needed to understand how it works and a description of how it meets the requirements; give this information in written and oral form, also in a way accessible to persons with disabilities, for as long as you provide the service (s. 6(1)(b) and (2); Directive (EU) 2019/882, Art. 13(2)).
• If the service does not meet the requirements, tell the supervisory authority, and the authority of any other Member State where you provide the service, without delay why not and what corrective measures you take, and take the necessary corrective measure within one year of that notice (s. 6(1)(d) and (e); Directive (EU) 2019/882, Art. 13(4)).
• On a reasoned request, give the supervisory authority the documentation and all information needed to show that the service conforms, in the state language, and cooperate on each corrective measure (s. 6(1)(f); Directive (EU) 2019/882, Art. 13(5)).
• Where the requirements do not cover a function of the service, make that function accessible under the functional criteria in Annex 3 of Government Regulation 283/2023 so that persons with disabilities can use it as far as possible; you may use the functional criteria instead of a specific technical requirement where the requirements allow it and the result is equal or better accessibility (s. 5(1) and (2)).
• Assess whether that defence applies, keep the result for five years from the day you last provided the service, give the supervisory authority a copy on request, and renew the assessment when the service changes, when the authority asks and at least every five years (s. 7(2) and (3); Directive (EU) 2019/882, Art. 14(2), (3) and (5)).
• You cannot rely on the disproportionate-burden defence if you took funds from sources other than your own for the purpose of improving the accessibility of the service (s. 7(4); Directive (EU) 2019/882, Art. 14(6)).
• If you apply the requirements only to the extent the defence allows, notify that in writing to the supervisory authority and to the authority of the Member State where you provide the service (s. 7(5); Directive (EU) 2019/882, Art. 14(8)).
• A service that conforms to harmonised standards or parts of them whose references are published in the Official Journal of the European Union, or to technical specifications or parts of them, is taken to meet the requirements to the extent those standards or specifications cover them (s. 4(2) and (3); Directive (EU) 2019/882, Art. 15).
• For air, bus, rail and water passenger transport services, the requirements are taken as met to the extent they correspond to the accessible-information requirements that the passenger rights regulations set (s. 4(4)).
• You need not meet the requirements to the extent that doing so would need a significant change that alters the basic nature of the service or would impose a disproportionate burden on you under the criteria in Annex 4 of Government Regulation 283/2023 (s. 7(1); Directive (EU) 2019/882, Art. 14(1)).
• The Act does not apply to services provided by a microenterprise, defined by reference to Commission Recommendation 2003/361/EC: fewer than 10 persons employed and an annual turnover and/or annual balance sheet total of no more than EUR 2 million, counting partner and linked enterprises; an enterprise 25 percent or more of whose capital or voting rights is controlled by public bodies does not count as one (s. 2(3) and footnote 4; Recommendation 2003/361/EC, Annex, Arts. 2(3), 3 and 3(4); Directive (EU) 2019/882, Art. 4(5)).
• The Act does not apply, for urban, suburban and regional transport, to the websites, mobile services and applications, electronic tickets and travel information of section 2(1)(a), points 1 to 4 (the self-service terminals of those services stay covered), to the content of online maps whose key navigation information is provided in an accessible digital manner, or to content that neither you nor an entity under your control created or financed (s. 2(2)).
• A service provided under a contract concluded by 28 June 2025 need not meet the requirements until that contract ends, at the latest until 28 June 2030 (s. 12(1); Directive (EU) 2019/882, Art. 32(1)).
• Pre-recorded time-based media and office file formats published on websites and in mobile applications before 28 June 2025, and websites and mobile applications that count as archives and hold only content not updated or edited after that day, are outside the requirements (s. 12(2)).
• The accessibility requirements for electronic communications services, for services giving access to audiovisual media services and for emergency communications to 112 are set by special regulations and not by this Act (s. 2(5)).
• The service accessibility duties reach information society services in the sense of section 2(a) of Act 22/2004 (a service provided at a distance over an electronic communications network, usually for remuneration, at the recipient's request) when provided to consumers (s. 2(1)(d) and footnote 3).