SlovakiaOffice for Personal Data Protection Enforcement and GDPR Article 82
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person in Slovakia who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Slovakia's general Criminal Code (Zakon c. 300/2005 Z. z., Trestny zakon), section 374, Unauthorized Handling of Personal Data (Neopravnene nakladanie s osobnymi udajmi), criminalizes unlawfully providing, granting access to, or publishing another person's personal data that was either collected in connection with the exercise of public authority or the exercise of a person's constitutional rights, or obtained through the offender's own profession, employment, or function, where doing so breaches a duty set by generally binding law. The base offense carries imprisonment of up to one year; an aggravated form, where the act causes serious harm to the affected person's rights, is committed publicly, or is committed in a more serious manner, carries imprisonment of up to two years. This is a separate offence from section 247 (unauthorized access to a computer system, candidate sk-300-2005-coll-247) and from Act No. 18/2018 Coll., whose own sections 104 to 106 set out administrative fines only, with no criminal provision of its own.
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements of the basic principles for processing (Articles 5, 6, 7 and 9), the data subjects' rights (Articles 12 to 22), cross-border transfer conditions (Articles 44 to 49), Member State law obligations under Chapter IX, and non-compliance with a supervisory authority order under Article 58. Act No. 18/2018 Coll., section 104(2), reproduces this ceiling domestically without alteration: the Office may impose a fine of up to EUR 20,000,000, or for an undertaking up to 4 percent of total worldwide annual turnover for the preceding accounting year, whichever is higher. Section 104(1) carries the parallel lower EUR 10,000,000 or 2 percent tier matching GDPR Article 83(4), and section 104(3) applies the higher tier again to failure to comply with an Office order. Section 105 adds a national-only poriadkova pokuta (procedural fine) of EUR 2,000 to EUR 10,000 for obstructing a supervisory inspection, with no GDPR analogue.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Urad na ochranu osobnych udajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
Enforcement record
The Office's annual report for 2025 states that it finally imposed 542 fines totalling EUR 468,000 under the data protection legislation in 2025, and collected EUR 410,800; the count of 542 is of fines only. The report separately records 10 procedural fines for obstructing inspections, which are not counted. It describes a year-on-year rise in the number and total amount of fines.
- As of
- Trend
- Rising
- Currency
- EUR
- Source link
- https://dataprotection.gov.sk/files/annual-reports/uoou_sprava-stave-ochrany-osobnych-udajov_2025.pdf
- Fines per year
- 468,000
- Actions per year
- 542
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Which Slovak rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
GDPR Articles 82 and 83 set liability and administrative fines. They state no duty to create, keep or produce a log or record. The Office's inspection powers sit in sections of the Act that this row does not cite, so this row carries no audit or access value for them.
- Kind
- None
- As of
What this law does
Urad na ochranu osobnych udajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) is the supervisory authority under section 81(1) of the Slovak Personal Data Protection Act of 2018. Section 104(2) of that Act lets the Office fine up to EUR 20,000,000, or for an undertaking up to 4 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action against the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .