Slovenia

ZIUDHPUI designates the Agency for Communication Networks and Services of the Republic of Slovenia (AKOS) as Slovenia's single point of contact for the AI Act, the body responsible for setting up at least one AI regulatory sandbox, and the market-surveillance and compliance-oversight authority over high-risk AI systems the Act places within national competence, including systems listed in Annex I that are safety components of, or are themselves, products covered by named EU harmonisation legislation, and Annex III systems used in critical infrastructure, employment, public benefits eligibility, and emergency-services triage.

AKOS also monitors the transparency obligations of providers and deployers of certain AI systems and can act against a provider, product manufacturer, deployer, authorised representative, importer, or distributor found, during its supervision, to be in breach of the AI Act, and forwards complaints from Slovenian users against providers established elsewhere to the coordinator in that provider's own country.

Article 176(3) punishes, to the same extent as paragraph 2, whoever for themself or another acquires, produces, distributes, sells, imports, exports, or otherwise offers pornographic or other sexual material that involves a minor or a minor's realistic likeness, or whoever possesses such material or gains access to it by means of information or communication technology, or discloses the identity of a minor depicted in it.

Because the provision reaches material involving a minor's realistic likeness (njihove realistične podobe) and not only material depicting an actual child, it extends to a synthetic, computer-generated, or otherwise artificial depiction that realistically portrays what appears to be a minor.

ZVOP-2 Part II Chapter 4, Processing of Personal Data Using Biometrics and Genetic Data, imposes a default prohibition rather than a bare General Data Protection Regulation (GDPR) Article 9 lawful-basis test, read verbatim: Article 81(1) states processing of biometric personal data contrary to this chapter's provisions is prohibited; Article 81(2) requires any other law authorizing biometric processing to itself set the conditions of use; Article 81(3) bars linking biometric-data collections with other collections, or enabling their GDPR Article 20 portability, except where another law provides otherwise.

Separately, in Chapter 3 (Video Surveillance), Article 80 bans, on public surfaces, automated license-plate-recognition systems and systems processing biometric personal data, backed by Article 105 fines of EUR 5,000 to 30,000. Article 80 is entirely a public-video-surveillance provision; it does not carry a collective-redress or representative-action mandate, contrary to commentary that describes one. No voiceprint-specific definition has been located; ZVOP-2's own Article 3 definitions section is not reproduced here.

A controller must notify the Information Commissioner within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. Commentary describes a parallel channel under the Information Security Act for special processing; which categories of processing that extends to, and its relationship to the General Data Protection Regulation (GDPR) Article 33 duty, are not verified.

Slovenia adopted ZVOP-2 in December 2022, five years after the General Data Protection Regulation (GDPR) took effect, replacing the original 2004 ZVOP-1.

The Act's full text, hosted by the Information Commissioner, confirms the citation exactly as Uradni list RS, st. 163/22, and shows a later amendment by the Zakon o informacijski varnosti (Information Security Act, ZInfV-1, Uradni list RS, st. 40/25), in force 19 June 2025, whose Article 67 rewrote ZVOP-2 Article 23(1)'s terminology from security requirements to risk management measures as a NIS2-alignment update rather than a substantive privacy change.

Having legislated five years late rather than in the original 2018 rush, ZVOP-2 is noticeably more specific than a hurried transposition, most visibly in its dedicated biometric-data chapter.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier.

A single commentary source separately claimed ZVOP-2 requires certain sensitive-data categories to remain within Slovenia's territory; this is flagged as unverified rather than folded into this jurisdiction's cross-border finding, since intra-EEA localization is not what General Data Protection Regulation (GDPR) Chapter V regulates and no article citation or primary text supports the claim.

General Data Protection Regulation (GDPR) Articles 12-22 apply directly. ZVOP-2 Article 11, read verbatim, confirms general judicial protection including damages, available to a data subject in Slovenia without first exhausting an administrative complaint to the Information Commissioner.

A single commentary source separately described an Article 80 representative-action mechanism; primary text shows ZVOP-2's own Article 80 is the public-video-surveillance provision above, not a representative-action provision, so if that commentary claim has any basis it describes GDPR's own Article 80 rather than a ZVOP-2 provision, and the Author should not attribute a representative-action power to "ZVOP-2 Article 80".

Informacijski pooblascenec (the Information Commissioner) is Slovenia's supervisory authority. ZVOP-2 Articles 114-115 require the misdemeanor-law fining authority to weigh proportionality alongside General Data Protection Regulation (GDPR) Article 83(1) factors, and Article 115 allows a fast-track fine above the statutory minimum.

Article 116 requires processing operations under Article 23(1), which names biometric, health, and criminal or misdemeanor-record data as triggering categories, to come into compliance within three years of the law's entry into force. GDPR Article 82 arms an individual with a direct private right of action, exercised through ZVOP-2 Article 11's judicial-protection route.

Article 221 criminalizes unauthorized entry into, or breaking into, an information system, and unauthorized interception of data during its non-public transmission into or out of the system (paragraph 1); it separately criminalizes the unauthorized use, alteration, copying, transfer, or destruction of data in an information system, unauthorized entry of data into one, or obstructing the transfer of data or the system's operation (paragraph 2), makes an attempt of that second offense punishable (paragraph 3), and raises the penalty where the paragraph 2 act causes significant damage (paragraph 4).

Article 22(1) requires an essential or important entity to adopt technical, operational and organisational measures to secure the integrity, authenticity, confidentiality and availability of the network and information systems it uses for its work or to provide its services, and to prevent or reduce the impact of an incident on the recipients of its services and other services.

Article 22(2) requires those measures to follow an all-hazards approach covering at minimum management support for information and cybersecurity, personnel integrity checks before, during and after employment (cross-referencing Article 23), basic cyber-hygiene practices and training, human-resources security and access-rights management, backup management, the logging duty of Article 24, supply-chain security with minimum requirements for key suppliers, cryptography and encryption policy, and further items through paragraph 13.

Article 20 assigns responsibility for these measures to the entity's odgovorna oseba (responsible person, the individual who leads, supervises or manages a legal person's business, or is otherwise legally charged with ensuring its lawful operation, or the head of a public-administration body), who must approve the Article 22 measures, oversee their implementation, complete cybersecurity risk-management training at least every four years, and ensure regular staff training.

Article 6(1) binds an entity within Priloga 1 (Annex 1, highly critical sectors) or Priloga 2 (Annex 2, other critical sectors) that has at least 50 employees and an annual turnover or balance-sheet total of at least EUR 10 million; Article 6(2) drops that threshold for, among others, a public electronic-communications or trust-service provider, a top-level domain (TLD) registry or DNS provider, a sole national provider of the service, and a public-administration body.

Article 62(1) phases this duty in over eighteen months from the Act's 18 June 2025 commencement, to 18 December 2026, for the general population of essential and important entities; Article 62(2) held that date to one year (18 June 2026, already past) for an entity already designated as an essential-service operator under Article 6 of the predecessor Zakon o informacijski varnosti or a state-administration body designated under that Act's Article 9, which remained bound by the predecessor Act's own security requirements and penalties until its own one-year deadline passed.

This Act, the ZInfV-1, by its own Article 69(1) repeals the predecessor Zakon o informacijski varnosti (Uradni list RS, št. 30/18, 95/21, 130/22, 18/23 and 49/23), Slovenia's NIS1-era transposition, together with four implementing regulations and two general acts that carried the risk-management and security-documentation duties under it.

Article 29(3) of this Act, in the companion notification row, confirms that a provider of an online marketplace, an online search engine or a social-networking-services platform is among the essential or important entities this Article 6 scope reaches, naming them for variant notification treatment; that same population is bound by this row's Article 22 risk-management duty once it applies to them.

Article 29(1) requires an essential or important entity to notify its competent CSIRT group of every incident that has a significant impact on the provision of its services, an incident that is significant (pomemben incident) where it has caused, or could cause, the entity serious operational disruption or financial loss, or has affected, or could affect, another natural or legal person by causing substantial material or non-material damage.

Article 30(1) sets the notification clock: an early warning without delay, at latest within 24 hours of detecting the significant incident, indicating where relevant whether the incident is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect; a full notification without delay, at latest within 72 hours, updating that information with an initial assessment of the incident's severity and impact and, where available, threat indicators; an interim report on the CSIRT group's request; and a final report, at latest one month after the 72-hour notification, describing the incident, its severity and impact, the likely threat or root cause, mitigating measures taken or under way, and any cross-border effect, with a progress report substituting where the incident is still ongoing and the final report then due within one month of resolution.

Article 29(3) applies a variant scope to a DNS service provider, top-level domain (TLD) registry, cloud, data-centre or content-delivery-network provider, a managed-service or managed-security-service provider, and a provider of an online marketplace, an online search engine or a social-networking-services platform, directing them to the European Commission's NIS2 implementing acts for the particular cases in which an incident counts as significant for their service.

Article 29(6)-(7) requires the entity to inform the recipients of its services, without delay, of a significant incident likely to adversely affect them, and to communicate to a recipient potentially affected by a significant cyber threat the measures it can take in response.

No transitional provision reviewed here defers this duty; unlike the companion risk-management-measures row, Article 62 phases in only Articles 21 and 22, so this notification duty binds from the Act's own 18 June 2025 commencement.

A provider of an audiovisual media service in Slovenia must classify content that could harm a child's physical, mental or moral development into one of five bands, the most restrictive being adult content covering unjustified violence and pornography. Adult content on a non-linear service must sit behind a default-locked, PIN-code-equivalent technical control that only an adult who understands its purpose can unlock. Any personal data of a child collected through that control may be processed only to verify the user's age.

A video-sharing platform provider within Slovenian jurisdiction must adopt appropriate measures to protect children from content that could harm their physical, mental or moral development. The statute names an age-verification system for platform users and a user-managed parental-control system as example measures, alongside a published complaint-handling process for users. Data collected under these measures may be processed only to verify a user's age.

A media publisher established in the European Union holds an exclusive right to reproduce its media publication and to make it available to the public for use by an information-society-service provider.

The right excludes private or non-commercial use by individual users, the act of inserting a hyperlink, and use of individual words or very short extracts from the publication, and it does not affect the rights of the authors or related-rights holders whose works or subject matter the publication incorporates. It runs two years from the publication's first lawful publication.

An author is separately entitled to an appropriate share of the revenue the publisher receives from an information-society-service provider under this right, a share the author cannot waive.

Article 57.a permits, without authorization, reproduction of works lawfully accessed for text-and-data-mining purposes, defined as any automated analytical technique for analyzing text and data in electronic form to generate information such as patterns, trends, and correlations.

That general exception does not apply where the author has expressly and appropriately reserved use of the work, in particular through internationally recognized, standardized, machine-readable means carrying metadata and terms of use for a work publicly available online. Any contractual provision contrary to this article is void.

Article 57.b creates a separate, unconditional exception, without that reservation mechanism, for research organizations, public archives, libraries, museums, film or audio heritage institutions, and public broadcasters carrying out text and data mining for scientific research on works they lawfully access.