SloveniaZakon o varstvu osebnih podatkov (ZVOP-2), Personal Data Protection Act
Zakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS, st. 163/22
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request, Kept
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Slovenia.
These lines are LexLint's reading of the law's text. Also read by: Informacijski pooblaščenec (Information Commissioner of Slovenia) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ip-rs.si/varstvo-osebnih-podatkov/ključna-področja-uredbe/privolitev
- Guidance body
- Informacijski pooblaščenec (Information Commissioner of Slovenia)
- Open questions
- When does processing amount to exercising the statutory powers, tasks or official duties of the public sector ('izvrševanje zakonskih pristojnosti, nalog ali oblastnih obveznosti javnega sektorja'), which Article 6(2) of ZVOP-2 places outside consent-based processing by public bodies?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Log retention
The log is kept for two years from the end of the calendar year in which the actions were recorded, unless another law provides otherwise. Where an impact assessment or risk analysis finds a risk that longer retention manages effectively, it may be kept for at most five years from the end of that calendar year. Where the individual's access to the data is restricted under Article 18, the log is kept for two years after the restriction ends.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 5
- Minimum value
- 2
Logging duty
A controller keeps a processing log where automated systems carry out large-scale processing of special categories of data, regular and systematic monitoring of individuals, or processing for which an impact assessment finds a risk that a log manages effectively, or where a law so provides. The log covers collection, alteration, consultation, disclosure including transfers, erasure and any other processing action a law names. It records the type of action, the date and time, who carried it out and who the users of the data were, and the controller may add contents after its impact assessment. The log may be used only to show lawful processing, for internal control and supervision, to protect integrity and security, and to correct faults. Article 76(12) adds that a video surveillance operator logs every viewing or use of recordings.
- Kind
- Explicit
- As of
- Provision
- ZVOP-2, Article 22
- Trigger
- personal_data_processing
What this law does
Slovenia adopted ZVOP-2 on , replacing the original 2004 ZVOP-1. Article 67 of the Information Security Act (ZInfV-1, Official Gazette of the Republic of Slovenia 40/25), in force from , replaced the words on security requirements in Article 23(1) of ZVOP-2 with words on risk management measures.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .