SlovakiaAct on the Protection of Personal Data
Zakon c. 18/2018 Z. z. o ochrane osobnych udajov a o zmene a doplneni niektorych zakonov
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis under Section 13(1) of the Act and General Data Protection Regulation (GDPR) Article 6 before processing personal data of a person in Slovakia.
These lines are LexLint's reading of the law's text. Also read by: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://dataprotection.gov.sk/files/metod-urad/6/zakonnost_aktualizovana_verzia_22-01-2019.pdf
- Guidance body
- Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record, Data lineage
Logging duty
A controller, and a processor for the categories of processing it carries out for a controller, keeps a record of processing activities in paper or electronic form; section 37(5) lifts the duty for an employer with fewer than 250 employees unless the processing is likely to put data subjects' rights at risk, is not occasional, or involves special categories or criminal-conviction data. Section 40(6) adds a record of every personal data breach. Sections 68 and 69, in Part Three, bind only the competent authorities that process data for criminal-proceedings purposes: section 69 requires them to keep logs of collection, alteration, consultation, disclosure including transfers, combination and erasure, and the logs of consultation and disclosure must show the reason, the date and time, who consulted or disclosed the data and who received it, and must be made available to the Office on request where available.
- Kind
- Explicit
- As of
- Provision
- Act No. 18/2018 Coll., section 37(1) and (2)
- Trigger
- personal_data_processing
What this law does
Slovakia gives the General Data Protection Regulation (GDPR) domestic effect through Act No. 18/2018 Coll. on the Protection of Personal Data, effective . Section 13(1) lists the legal bases on which processing is lawful, including the data subject's consent, a contract, a special regulation or an international agreement that binds Slovakia, and the legitimate interests of the controller or a third party.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .