SlovakiaGDPR Articles 33-34, Breach Notification
Regulation (EU) 2016/679, Arts. 33-34
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the Slovak Office for Personal Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Slovakia, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
These lines are LexLint's reading of the law's text. Also read by: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://dataprotection.gov.sk/sk/prevadzkovatelia/oznamenie-poruseni-ochrany-osobnych-udajov/
- Guidance body
- Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller documents every personal data breach, whether or not it is notified; the text names the facts, the effects and the remedial action but no fixed log fields. Section 40(6) of Act No. 18/2018 Coll. restates the duty, naming the facts, the consequences and the remedial measures taken.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 33(5)
- Trigger
- security_incident
What this law does
A controller must notify the Office for Personal Data Protection of the Slovak Republic without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk.
Section 40(1) of Act No. 18/2018 Coll. states a 72-hour deadline from the time the controller becomes aware, which does not apply where the breach is unlikely to result in a risk to the rights of a natural person, and Section 40(2) requires a controller that misses it to give reasons for the delay. Section 41(1) requires the controller to tell the data subject without undue delay where the breach may lead to a high risk to the rights of a natural person.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .