SloveniaInformacijski pooblaščenec Enforcement, GDPR Article 82, and ZVOP-2 Articles 114-116
Regulation (EU) 2016/679, Art. 82; ZVOP-2, Arts. 105, 114-116
In force since , effective .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person in Slovenia who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Informacijski pooblaščenec (Information Commissioner) (guidance, recorded ); Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Kazenski zakonik (KZ-1) Article 143, Zloraba osebnih podatkov (Misuse of Personal Data), is a genuine criminal offense distinct from ZVOP-2's misdemeanor fine regime. Unauthorized public disclosure of personal data, or unauthorized access to a computerized personal data collection (paragraphs 1-2), carries a fine or imprisonment up to one year; disclosing sensitive personal data this way (paragraph 5) carries imprisonment up to two years; assuming another person's identity or exploiting their personal data for gain or to injure their dignity (paragraph 4) carries imprisonment from three months to three years; and the aggravated form, committed by an official through abuse of official position or official powers (paragraph 6), carries imprisonment up to five years, the article's maximum penalty.
Penalty structure
ZVOP-2 Article 95(1) incorporates the GDPR's own fine amounts and ranges directly as the misdemeanor (prekrsek) penalty for a legal person, sole proprietor, or individual conducting an independent activity, so the governing ceiling matches GDPR Article 83(5)'s higher tier: up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher (the lower Article 83(4) tier, EUR 10,000,000 or 2 percent, is recorded on the instrument covering GDPR Articles 33-34). ZVOP-2 Article 95(2) separately prescribes its own, smaller fixed-euro fine bands where GDPR's turnover-based formula cannot reach the violator: Article 96 sets EUR 100 to 5,000 for the responsible person of a legal person, sole proprietor, state body, or self-governing local community who violates the lower-tier GDPR Article 83(4) obligations, and Article 97 sets EUR 200 to 8,000 for the same class of responsible person, or EUR 200 to 2,000 for an individual, on the higher-tier GDPR Article 83(5)-(6) obligations. Article 114 requires the misdemeanor authority to weigh proportionality, profit or harm motive, and repeat-violation factors alongside the GDPR Article 83(1) criteria when setting any of these fines, and Article 115 lets the authority impose a fast-track (hitri postopek) fine above the statutory minimum.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Informacijski pooblascenec (Information Commissioner)
Enforcement record
Counts the fines the Information Commissioner imposed in calendar year 2025 for infringements of the General Data Protection Regulation (14 fines, EUR 177,020 in total) and of the Personal Data Protection Act ZVOP-2 (59 fines, EUR 110,220 in total), per its Annual Report 2025; these are the first fines it imposed under the Regulation, a power it gained with ZVOP-2. Across all misdemeanor proceedings that year the Commissioner imposed 89 fines (EUR 294,390 in total, the balance under other statutes including 6 fines under the electronic communications act ZEKom-2), 45 reprimands, 2 payment orders and 42 warnings; reprimands, payment orders and warnings are not counted here.
- As of
- Source link
- https://www.ip-rs.si/fileadmin/user_upload/Pdf/porocila/LP2025.pdf
- Actions per year
- 73
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Guidance link
- https://www.ip-rs.si/mnenja-gdpr/od%C5%A1kodnina-po-gdpr-1638873639
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Guidance body
- Informacijski pooblaščenec (Information Commissioner)
- Open questions
- Which Slovenian rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
GDPR Article 82 and ZVOP-2 Articles 105 and 114 to 116 set liability, fines and the transition period. They state no duty to create, keep or produce a log or record. ZVOP-2 Article 22, which this row does not cite, requires a processing log in the cases it names.
- Kind
- None
- As of
What this law does
Informacijski pooblascenec (the Information Commissioner) is Slovenia's supervisory authority. ZVOP-2 Articles 114-115 require the misdemeanor-law fining authority to weigh proportionality alongside General Data Protection Regulation (GDPR) Article 83(1) factors, and Article 115 allows a fast-track fine above the statutory minimum. Article 116 requires the processing operations under Article 23(1) to come into compliance with Article 23 within three years of the law's entry into force.
GDPR Article 82 arms an individual with a direct private right of action, exercised through ZVOP-2 Article 11's judicial-protection route.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .