Slovakia

Section 132(4) defines child pornography, for the purposes of the Trestny zakon, as a depiction of real or simulated sexual intercourse, another form of sexual contact, or similar sexual activity with a child or a person appearing to be a child, or a depiction of the exposed body parts of a child or a person appearing to be a child for sexual purposes.

Because that definition reaches a simulated act and a person merely appearing to be a child, it is not limited to a depiction of an actual sexual act with a real child; the Code does not say in terms whether a wholly computer-generated image is covered.

Section 368 punishes using, obtaining, offering or otherwise exploiting a child for the production of child pornography or a child-pornographic performance, or otherwise taking part in such production, with imprisonment of four to ten years, rising to seven to twelve years, ten to fifteen years, or twelve to twenty years for aggravated forms.

Section 369 punishes reproducing, transporting, procuring, making accessible, or otherwise distributing child pornography with imprisonment of one to five years, rising to three to eight years, four to ten years, or seven to twelve years for aggravated forms. Section 370 punishes possessing child pornography, or acting with intent to access it through an electronic communication service, with imprisonment of up to two years.

A controller must notify the Office for Personal Data Protection of the Slovak Republic without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk.

Section 40(1) of Act No. 18/2018 Coll. states a 72-hour deadline from the time the controller becomes aware, which does not apply where the breach is unlikely to result in a risk to the rights of a natural person, and Section 40(2) requires a controller that misses it to give reasons for the delay. Section 41(1) requires the controller to tell the data subject without undue delay where the breach may lead to a high risk to the rights of a natural person.

Slovakia gives the General Data Protection Regulation (GDPR) domestic effect through Act No. 18/2018 Coll. on the Protection of Personal Data, effective 25 May 2018. Section 13(1) lists the legal bases on which processing is lawful, including the data subject's consent, a contract, a special regulation or an international agreement that binds Slovakia, and the legitimate interests of the controller or a third party.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. Section 48(1) and (2) of Act No. 18/2018 Coll. allow a transfer to a third country where the Commission has decided that it ensures an adequate level of protection, and otherwise only where appropriate safeguards are provided.

Section 48(4) adds that safeguards may also rest on contractual clauses between the controller or processor and a recipient in the third country, on the authorisation of the Office. Section 51(1) allows a transfer with neither only in the listed special situations, such as the data subject's explicit consent after being told of the risks.

General Data Protection Regulation (GDPR) Article 22 gives a person in Slovakia the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Section 28 of Act No. 18/2018 Z. z. restates this rule without adding an authorisation or safeguard.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Slovakia can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

Act No. 18/2018 Z. z. restates these rights and, in Section 78(8) and (9), allows a separate law or treaty to restrict access, rectification, restriction and objection, and for archiving also portability, for research, statistics and archiving under safeguards; it never allows erasure or the automated-decision right to be restricted that way.

Urad na ochranu osobnych udajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) is the supervisory authority under section 81(1) of the Slovak Personal Data Protection Act of 2018. Section 104(2) of that Act lets the Office fine up to EUR 20,000,000, or for an undertaking up to 4 percent of total worldwide annual turnover for the preceding financial year, whichever is higher. General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action against the controller or processor.

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Section 16(1) of Act No. 18/2018 Coll. restates the prohibition on processing special categories of personal data, which include biometric data. Section 78(5) lets a controller process genetic, biometric and health data on the legal basis of a special regulation or an international agreement that binds Slovakia, a general enabling clause rather than a biometric-specific rule.

Section 78(4) allows the generally usable identifier to be used to identify a person only where that use is necessary for the purpose, requires consent to its processing to be explicit, and prohibits publishing it unless the data subject publishes it themself. The special regulation that the generally usable identifier points to is Act 301/1995 Coll. on the birth number (rodne cislo).

Section 247 punishes a person who overcomes a security measure and thereby obtains unauthorized access to a computer system or part of it with imprisonment of up to two years, rising to six months to three years where the act is committed in a more serious manner or causes significant damage, and to one to five years where it causes large-scale damage or is committed as a member of a dangerous grouping.

Because the offence applies only where a security measure is overcome, reading a public, unauthenticated page without defeating any access control falls outside the wording of this section.

Section 247a punishes unauthorized interference with a computer system's operation, section 247b unauthorized interference with computer data, section 247c unauthorized interception of non-public computer-data transmissions, and section 247d the production, import, or sale of a device, password, or access code created for unauthorized access to a computer system, each with escalating tiers.

The most serious forms of sections 247a, 247b and 247c carry two to eight years' imprisonment, and the most serious form of section 247d carries one to five years.

Section 51b, inserted by Act 71/2022 Coll., lets a library, archive, museum, school, or statutory depositary reproduce a work for text-and-data-mining for research purposes without the author's consent, with no rightsholder opt-out. It lets the reproduction be retained for research purposes, including verifying the research results. Section 51c gives any person a general text-and-data-mining exception, defeated where the rightsholder has expressly reserved that use.

A reproduction made under section 51c may be kept only as long as needed for the mining. Section 51b(2) defines data mining, for the purposes of the Act, as any automated analytical technique aimed at analysing data in digital form to obtain patterns, trends, correlations, or similar results.

A database that shows a qualitatively or quantitatively substantial investment in obtaining, verifying or presenting its contents gives its maker the exclusive right to use the database and to consent to extraction or reutilization of its whole contents or of a qualitatively or quantitatively substantial part. The maker is the person who initiated and secured the making of the database.

Extraction is the permanent or temporary making of a copy of the database by transferring its whole contents or a substantial part to another medium by any means in any form. Reutilization is any way of making the whole contents of the database or a substantial part available to the public, including distributing copies by transfer of ownership and by rental.

Repeated and systematic extraction or reutilization of insubstantial parts of the contents is prohibited if it conflicts with the normal use of the database and unreasonably interferes with the maker's legally protected interests. A user may extract or reutilize a qualitatively and quantitatively insubstantial part of the contents for any purpose without the maker's consent.

A user of a publicly accessible database must not use it against the normal use of the database or unreasonably interfere with the maker's legally protected interests. Extraction or reutilization by use under Sections 49a, 51b and 51c is among the listed exceptions to the special right. The right lasts 15 years from the making of the database or from the day public access to it was allowed, whichever came later. The right ends on the last day of the calendar year in which the 15 years expire. The Act entered into force on 1 January 2016.

Decree 111/2026 of the Ministry of Transport (Vyhláška Ministerstva dopravy Slovenskej republiky) sets the sector security measures in the Ministry's remit, was approved on 25 May 2026, promulgated on 3 June 2026 and took effect on 1 July 2026. Section 1 sets the sector cyber security measures for rail transport in Annex 1 and for road transport in Annex 2. The Ministry issues the decree in cooperation with the National Security Authority under Section 32(2) of Act 69/2018.

Decree 227/2025 of the National Security Authority on security measures (Vyhláška Národného bezpečnostného úradu o bezpečnostných opatreniach) was approved on 26 August 2025, promulgated on 28 August 2025 and took effect on 1 September 2025, and repealed Decree 362/2018.

It sets the content of the security measures, the scope of the general security measures for networks, information systems and operational technologies, and the content and structure of the security documentation under Section 20 of Act 69/2018.

The security documentation contains an approved cyber security strategy, approved security policies, a classification of information, the assignment of networks and information systems to a category, a risk analysis with the level of identified, accepted and residual risks and a list of assets, a documented determination of the security measures adopted and not adopted with reasons, and the last final audit report.

Risk management includes asset identification, risk identification, risk analysis, risk assessment, adoption of security measures with reasons for any measure not adopted, and a review of the identified risks at least once a year. The operator keeps a centrally managed register of assets, made up of primary assets, supporting assets, asset owners and the persons responsible for identifying and recording the assets.

Section 20(3) of Act No. 69/2018 has security measures adopted and carried out in the scope and manner this decree sets, or that a special regulation sets where one has been issued. The Act's note 24 to that special regulation gives Regulation (EU) 2022/2554 (DORA) as its first example. Section 29(9) has an essential-service operator that DORA covers verify the effectiveness of its security measures under DORA.

Section 17 requires a person the sector annexes reach, including a central state-administration body and a digital provider named at Section 2(2) (DNS, domain-name registration, cloud computing, data centre, content delivery network, managed service, security service, online marketplace, online search engine or social-networking-services platform), to register as an essential-service operator (prevádzkovateľ základnej služby); a person meeting at least the medium-enterprise size threshold in an Annex 1 or Annex 2 sector registers under Section 17(1)(e).

Section 19(1) then requires the operator to adopt, maintain and carry out general security measures, within 12 months of registration and graded by its own risk analysis, covering at minimum the 18 domains Section 20(2) lists (security governance, vulnerability and threat management, asset and risk management, incident handling, business continuity and backup, secure development and acquisition, compliance monitoring, cryptography, human-resources security, identity and access management, network operations security, malware and unwanted-content protection, system, network and communications security, event logging and monitoring, physical and endpoint security, records and privacy protection, supply-chain security, and the use of certified ICT products, services and processes), and Section 19(6)(h) requires the operator to build an effective mechanism for promptly informing its statutory body and responsible senior staff about cyber threats, incidents, near-misses and risk-treatment status.

Section 18 defines a "critical basic service" (kritická základná služba) to include the exercise of a central state-administration body's functions.

It also includes, broadly, a large enterprise (above the medium-enterprise threshold) active in an Annex 1 sector other than public administration, and separately a qualified trust service, a top-level domain (TLD) registry, a DNS service, or an at-least-medium-sized public electronic communications network or service; an operator with this status must itself report it to the Authority, and it draws a higher administrative-penalty tier for the same duties.

The Act transposes NIS2 Article 21 without adopting NIS2's own "essential entity"/"important entity" labels; the National Security Authority's implementing Vyhláška (Decree) on security measures, referenced at Section 20(3), specifies the manner and scope in which these measures are carried out.

Decree 226/2025 of the National Security Authority (Vyhláška Národného bezpečnostného úradu) sets the details of reports under Act 69/2018 on cyber security, was approved on 26 August 2025, promulgated on 28 August 2025 and took effect on 1 September 2025.

Annex 1 defines the criteria for a serious disruption of the operation of an essential service operator, among them a complete outage of more than 30 minutes for an operator of a critical essential service or 60 minutes for another essential service operator, an impairment of more than 60 or 180 minutes, an economic loss above 0.1 percent of gross domestic product and a loss to at least one user above EUR 250,000.

Annex 2 sets what a report of a serious cyber security incident under Section 24(3)(a) and (b) of the Act contains, namely the reporter's identity and contact data and the time of detection, a description of the incident and its consequences or expected scope, whether it may have been caused by unlawful conduct, whether it may have cross-border impact and the effect on trust services, and, in the follow-up report, updated information and the status and reactive measures taken.

Annex 3 sets what a report of a significant cyber threat, a near miss or a vulnerability under Section 24(5), and a report of an incident, threat or near miss under Section 24(6), contains, and for a vulnerability also the identification or description of the ICT product, ICT service or operational technology concerned and its manufacturer or provider where known to the reporter.

Section 24(8) of Act No. 69/2018, whose reports this decree details, has an essential-service operator that Regulation (EU) 2022/2554 (DORA) covers meet its reporting duty by reporting a major ICT-related incident through DORA's competent authority, in the scope, manner and time limits DORA sets.

Section 24(1) requires an essential-service operator to report every significant cyber security incident (závažný kybernetický bezpečnostný incident), defined at (2) as a large-scale incident, or one that has caused or may cause serious disruption to the operator or large-scale damage or lost profit, or that has affected or may affect others with significant harm.

Section 24(3) sets the graduated clock NIS2 Article 23 requires, beginning with an early warning reported without undue delay and no later than 24 hours from detection. No later than 72 hours from detection, the operator must report a notification updating that early warning with an initial severity and impact assessment, and must report further updates on the computer security incident response team (CSIRT) unit's request. A final report is due no later than one month after that 72-hour notification.

Where an incident with cross-border impact is still ongoing when that final report is due, an updated final report is due within 30 days of restoring normal network and system operation, and where any significant incident is still ongoing when the final report is submitted, further information and an updated final report are due within 30 days of its resolution.

Section 24(5) extends the same reporting channel to a significant cyber threat the operator becomes aware of, a near-miss event that could have caused a significant incident, and a vulnerability in the operator's own publicly available networks or systems that it could not remediate or mitigate in reasonable time.

Section 24(8) lets an operator that is a financial entity under the EU Digital Operational Resilience Regulation (Regulation (EU) 2022/2554) satisfy this duty instead by reporting a major ICT-related incident through DORA's own competent-authority channel.

Separately, Section 5(5) gives the Authority, acting through its national CSIRT unit, a coordinator role for communication about a discovered or reported vulnerability among the essential-service operator, the manufacturer or supplier of the affected ICT product or ICT service, and other affected persons, a duty the Act places on the Authority rather than on the manufacturer directly.

Section 116, paragraph 3 of the Electronic Communications Act allows the use of automated calling and communication systems without human intervention, telefax, e-mail, SMS and MMS for direct marketing to a subscriber or user only with their provable consent obtained before contacting them. Section 116, paragraph 4 prohibits calling, and using automated calling and communication systems without human intervention, telefax, e-mail, SMS and MMS, for the purpose of obtaining that consent.

Section 116, paragraph 5 requires the person to whom consent was given to keep a durable medium recording the provable consent for at least four years from its withdrawal. Section 116, paragraph 5 also requires a person doing direct marketing to state, when obtaining consent, how the consent can easily be withdrawn.

Section 116, paragraph 6 lets a subscriber or user withdraw consent or object to calls at any time, and requires the person concerned to confirm the withdrawal or objection provably within 30 days and to keep the confirmation on a durable medium for at least four years.

Section 116, paragraph 15 removes the prior consent requirement for e-mail, SMS and MMS direct marketing of the person's own similar goods and services where the person obtained the contact details in connection with a sale, and for marketing addressed to the published contact details of a subscriber or user who is a sole trader or a legal person.

Section 116, paragraph 15 requires that the recipient be given a possibility to refuse that use of contact details easily and free of charge at any time, when the details are collected and in every message delivered, if the recipient has not refused before.

Section 116, paragraph 15 prohibits sending e-mail from which the identity and address of the sender, to which the recipient can send a request to end such messages, are not known, and encouraging a visit to a website in breach of a special regulation. Section 116, paragraph 16 allows contact details obtained in connection with a sale to be used under paragraphs 14 and 15 for one year after the end of the contractual relationship.

Section 124, paragraph 3 makes a breach of section 116, paragraphs 3 to 6, 8, 12 and 14 to 16 punishable by a fine of EUR 200 up to 5 percent of turnover for the previous accounting period. Section 124, paragraph 6 limits the fine under paragraphs 1 to 3 to EUR 300,000 where the person had no turnover for the previous accounting period or the turnover cannot be calculated.

Section 134 provides that the Act takes effect on 1 February 2022, except that paragraph 12 of section 116 takes effect on 1 August 2022 and paragraphs 7 to 10 of section 116 take effect on 1 November 2022.

Section 109, paragraph 8 of the Electronic Communications Act allows anyone who stores information in a user's terminal device, or gains access to information stored there, to do so only if the user has given provable consent meeting the requirements of a special regulation. The duty to obtain consent does not apply to a law enforcement authority or another state authority.

The consent duty does not prevent technical storage of data or access to it whose only purpose is the transmission or facilitation of the transmission of a message through a network, or that is unconditionally necessary for the provider of an information society service to provide a service the user expressly requests. Section 124, paragraph 3 makes a breach of section 109, paragraph 8 punishable by a fine of EUR 200 up to 5 percent of turnover for the previous accounting period.

Section 124, paragraph 6 limits the fine under paragraphs 1 to 3 to EUR 300,000 where the person had no turnover for the previous accounting period or the turnover cannot be calculated.

Section 117, paragraph 1 of the Electronic Communications Act makes the content of transmitted messages, data about the communicating party, traffic data and location data the object of telecommunications secrecy. Section 117, paragraph 2 requires everyone who comes into contact with the object of telecommunications secrecy, in the provision of networks and services, in the use of services, by chance or otherwise, to maintain it.

Section 124, paragraph 1 makes a breach of section 117, paragraph 2 punishable by a fine of EUR 200 up to 10 percent of turnover for the previous accounting period. Section 124, paragraph 6 limits the fine under paragraphs 1 to 3 to EUR 300,000 where the person had no turnover for the previous accounting period or the turnover cannot be calculated.

Section 116, paragraph 7 of the Electronic Communications Act requires the Authority to set up and run on its website a list of the telephone numbers that subscribers or users have entered to express disagreement with calls for direct marketing. Section 116, paragraph 8 prohibits any call for direct marketing if the subscriber or user has entered the telephone number in the list or has objected to such calls to the person for whom the marketing is done.

The prohibition in paragraph 8 does not apply if the subscriber or user gave the person for whom the marketing is done consent after the last update of the entry in the list. Section 116, paragraph 9 gives the subscriber or user the right at any time to enter a telephone number in the list or update the entry free of charge.

Section 116, paragraph 10 requires the person doing direct marketing to check the entry of a telephone number or group of numbers in the list on the Authority's website and to pay the fee the Authority sets for the check.

Section 116, paragraph 12 requires a person doing direct marketing by calls, automated calling and communication systems, telefax, SMS or MMS, or obtaining prior consent to such calls, to use for that purpose only numbers identified by the national destination code for it in the numbering plan. That duty does not apply to direct marketing calls made to the published contact details of a subscriber or user who is a sole trader or a legal person.

Section 116, paragraph 14 provides that paragraphs 8 and 12 do not apply to direct marketing of the person's own similar goods and services where the person obtained the contact details in connection with a sale or has a contractual relationship with the subscriber or user, or to a subscriber or user who requested such communication in advance in a provable way.

Section 116, paragraph 14 requires that the subscriber or user be given a possibility to refuse that use of contact details easily and free of charge at any time, when the details are collected and at every contact for direct marketing. Section 124, paragraph 3 makes a breach of section 116, paragraphs 3 to 6, 8, 12 and 14 to 16 punishable by a fine of EUR 200 up to 5 percent of turnover for the previous accounting period.

Section 134 provides that the Act takes effect on 1 February 2022, except that paragraph 12 of section 116 takes effect on 1 August 2022 and paragraphs 7 to 10 of section 116 take effect on 1 November 2022.

Section 110(3)(w) and (x) make the regulator, the Council for Media Services (Rada pre mediálne služby), perform the tasks of the digital services coordinator and take part in the work of the European Board for Digital Services. Section 110(3)(y) has the regulator decide on the certification of out-of-court dispute settlement bodies, on the granting, suspension and withdrawal of trusted flagger status, and on vetted researcher status and access to data.

Section 133b(1) lets the regulator require a provider of an intermediary service, and any other person acting in the course of business who may reasonably be expected to have information on a suspected infringement, to provide that information free of charge within the time the regulator sets. Section 133b(3) obliges the provider, such a person, their employees and persons acting on their behalf to give the regulator cooperation and correct, complete and true information and explanations.

Section 133d lets the regulator impose a proportionate interim measure on a provider where recipients of the service face a risk of serious harm, for up to four weeks at a time, with an objection in ten days that has no suspensive effect. Section 133e(1) lets the regulator suspend the proceedings and declare a commitment offered by a provider to ensure compliance binding on it.

Section 145b(1)(a) obliges the regulator to fine a provider of an intermediary service up to 6 percent of annual worldwide turnover in the preceding accounting period for breaching the listed provisions of Regulation (EU) 2022/2065. Section 145b(1)(b) obliges the regulator to fine a provider of online intermediation services or an online search engine EUR 100 to EUR 50,000 for breaching the listed provisions of Regulation (EU) 2019/1150.

Section 145b(3) lets the regulator fine a provider of online intermediation services or an online search engine EUR 50 to EUR 10,000 where, in supervision, it fails to give information on a suspected infringement, gives incorrect, incomplete or misleading information, does not correct it when called upon, does not submit to supervision, or does not meet a commitment declared binding on it.

Section 145b(2) lets the regulator fine a provider of an intermediary service up to 1 percent of annual income or worldwide turnover where it fails to give information on a suspected infringement, gives incorrect, incomplete or misleading information, does not correct it when called upon, or does not submit to supervision.

Section 145b(4) lets the regulator impose a periodic penalty of up to 5 percent of average daily worldwide turnover or income to compel a provider to give correct and complete information, submit to supervision, comply with an interim measure, a commitment or an action plan, or comply with a corrective measure.

Section 150(11) requires the regulator, where its review shows that a complaint concerns an intermediary service under the jurisdiction of another Member State's digital services coordinator, to forward the complaint to that coordinator. Section 150(13) gives the complainant and the provider of the intermediary service the right to be heard and to receive adequate information on the state of the complaint.

The amending Act of 24 July 2024, number 203/2024 of the Collection of Laws, inserted these provisions into the Act and took effect on the day of its promulgation, 24 July 2024, except for points 4, 5, 19 and 22 of its Article I.

Section 20 provides that the Act takes effect on 9 December 2026. The annex to the Act lists Directive (EU) 2024/2853 as the act it transposes. Section 17(1) applies the Act to damage caused by a defective product placed on the market or put into service from 9 December 2026. Section 17(2) leaves the rules in force up to 8 December 2026 governing the liability for a product placed on the market or put into service up to that day.

Section 19 repeals Act No. 294/1999 Z. z. Section 2(a) counts electricity, a digital manufacturing file, a raw material and software as a product. Section 1(2)(a) excludes free and open-source software that was developed or supplied outside a business activity. Section 3(1) gives a natural person to whom a defective product caused damage the right to compensation. Section 4(1)(a) covers death or damage to health, including medically recognized damage to psychological health.

Section 4(1)(b) covers damage to or destruction of property, except the defective product itself, a product damaged by a defective component that the manufacturer integrated or connected or that is under its control, and property used exclusively for business or professional purposes. Section 4(1)(c) covers destruction or corruption of data, except data used for business or professional purposes.

Section 5(1) makes a product defective if it does not provide the safe use that can reasonably be expected or that special provisions lay down. Section 5(2)(c) weighs in judging a defect the effect of the product's ability to keep learning or to acquire new features after it is placed on the market or put into service. Section 5(2)(f) weighs in judging a defect the relevant product-safety requirements, including cybersecurity requirements that relate to the safety of the product.

Section 6(1) makes the manufacturer of a product liable for damage caused by a defective product. Section 6(2) makes the manufacturer of a defective component that is integrated into or connected with the product under the manufacturer's control liable together with the manufacturer of the product.

Section 6(3) makes the importer, the authorized representative and, where neither is established in a Member State, the provider of logistics services liable in addition where the manufacturer is not established in a Member State. Section 6(4) makes the distributor liable where no liable person established in a Member State can be identified and the distributor does not name one within one month of the injured person's request.

Section 6(5) extends section 6(4) to the provider of an online platform that allows a consumer to conclude a distance contract with a trader, where the provider is not an economic operator and the conditions of a special provision are met. Section 6(6) makes a person who makes a product available on the market or puts it into service after a substantial modification outside the manufacturer's control liable.

Section 7(1)(e) releases a liable person on proof that the objective state of scientific and technical knowledge did not allow the defect to be discovered. Section 7(4) denies the release for a defect that arose after the product was placed on the market where a related service, software including its updates or upgrades, a missing software update or upgrade needed to maintain safety, or a substantial modification under the manufacturer's control caused the defect.

Section 8 bars excluding or limiting the liability towards the injured person and makes a unilateral declaration or an agreement that does so void. Section 9 makes two or more liable persons liable jointly and severally. Section 12 time-bars the claim three years after the injured person learned or could have learned of the damage, the defect and the identity of the liable person.

Section 13(1) extinguishes the right to compensation if the injured person does not claim it within ten years of the day the defective product was placed on the market or put into service. Section 13(2) extends that period to 25 years where a delayed manifestation of injury to health prevented the injured person from claiming within ten years.

Section 14(1) has the court order the defendant, on the claimant's application, to disclose relevant evidence in its control once the claimant presents facts and evidence sufficient to support the plausibility of the claim. Section 15(2)(a) presumes the product defective where the defendant does not disclose the relevant evidence it holds.

Section 15(2)(b) presumes the product defective where the claimant shows that it does not meet product-safety requirements under special provisions that are meant to protect against the damage suffered. Section 15(4) has the court presume the defect, the causal link or both where the claimant has excessive difficulty in proving them because of technical or scientific complexity and shows that they are probable.

Section 1(1) makes the producer liable for damage a defective product causes to the health or life of the injured person, or to a thing other than the defective product that is ordinarily intended for personal use or consumption and served the injured person mainly for that purpose. Section 1(1) leaves the injured person to prove the defect, the damage and the causal link between the defective product and the damage.

Section 1(2) covers damage to a thing other than the defective product only where the damage exceeds 20,000 Slovak korunas. Section 2(1) defines a product as any movable thing that was made, extracted or otherwise obtained and is intended to be placed into circulation. Section 2(1) also treats electricity and gas intended for consumption as a product.

Section 3(1) makes a product defective if it does not guarantee the safety of its use that can reasonably be expected, having regard in particular to its presentation and the information given about it, its expected use and purpose, and the time it was placed into circulation. Section 3(2) provides that a product is not defective only because a more perfect product was placed into circulation.

Section 4(1) makes the producer the person who made, extracted or otherwise obtained the product, or who presents itself as the producer by its name, trade mark or another distinguishing mark. Section 4(2) also treats as a producer whoever imports a product from abroad for sale, hire or another form of use in the course of its business.

Section 4(3) treats every supplier as the producer where the producer cannot be identified, unless the supplier names the producer or its own supplier to the injured person within one month of the claim. Section 4(3) applies the same rule to an imported product whose importer cannot be identified, even where the producer is known. Section 5(1)(a) releases the producer from liability on proof that it did not place the product into circulation.

Section 5(1)(b) releases the producer on proof that, according to the circumstances that preceded the damage, the product can be taken to have been free of the defect when it was placed into circulation or that the defect arose later. Section 5(1)(c) releases the producer on proof that it did not make the product for sale or other use for business purposes and did not distribute it in the course of its business.

Section 5(1)(d) releases the producer on proof that the defect results from compliance with a duty arising from a generally binding legal provision. Section 5(1)(e) releases the producer on proof that the state of scientific and technical knowledge when the product was placed into circulation did not allow the defect to be discovered.

Section 5(2) releases the producer of a component on proof that the overall design of the product, the requirements of the producer of the overall product or the instructions for use of the overall product caused the defect. Section 6(2) limits the producer's liability to 3,500 million Slovak korunas where the same defect in identical products injured the health or life of several persons.

Section 6(3) reduces the compensation where the producer proves that the fault of the injured person also contributed to the damage. Section 6(4) makes two or more liable producers liable jointly and severally. Section 7(1) keeps the producer liable for the whole damage where an act or omission of a third person also contributed to it. Section 8 bars excluding or limiting the producer's liability in advance by contract.

Section 9(1) time-bars the claim three years after the day the injured person learned or could have learned of the damage and of the identity of the producer. Section 9(2) time-bars the claim at the latest ten years after the day the producer placed the defective product into circulation. Section 10 disapplies the Act to damage caused by a nuclear event governed by a special provision. Section 12 provides that the Act takes effect on 1 December 1999. The Act was promulgated on 13 November 1999.

Section 19 of Act No. 242/2026 Z. z. repeals the Act. Section 17(2) of Act No. 242/2026 Z. z. keeps the Act in force for a product placed on the market or put into service up to 8 December 2026.

Section 48(1)(a) requires a video-sharing platform provider to adopt appropriate measures to protect minors from programmes, user-created videos, and audiovisual commercial communications that may impair their physical, psychological, or moral development.

Section 49 lists measures the provider may take depending on the case, including embedding the protective rules in the platform's terms of use, a reporting and flagging mechanism for content covered by section 48, a complaints procedure, and media-literacy tools. Among those listed measures is a parental-control system controlled by the user. Section 49 also lists an age-verification system for users in relation to content that may impair minors' development.

Section 50 lets the regulator request data from the provider to assess whether its measures are suitable, and to request further information where the data supplied does not let the regulator make that assessment. Personal data collected under the parental-control or age-verification measures may not be processed for commercial purposes.

Section 129c(1) to (2), inserted by Act 71/2022 Coll. transposing Article 15 of the EU Digital Single Market Copyright Directive, gives a periodical's publisher the exclusive right to use the periodical and to authorise its use, so an information-society service provider may reproduce or make the periodical available online only with the publisher's consent unless the Act provides otherwise.

Section 129c(4) exempts an individual user's private, non-commercial use, hyperlinking, and the use of a headline, individual words, or a very short extract incapable of substituting for the whole periodical. Section 129d limits the right's duration to two years from the periodical's publication, ending on the last day of the calendar year in which that term lapses.

A transitional provision excludes any periodical first published before 6 June 2019 from section 129c. Section 129h requires the publisher to pay rightsholders whose works are included in the periodical an appropriate share of the remuneration it receives from licensing an information-society service provider, within six months of the right's expiry.

Section 51c, inserted by Act 71/2022 Coll. transposing Article 4 of the EU Digital Single Market Copyright Directive, does not require an author's consent to reproduce a work for text-and-data-mining, unless the rightsholder has expressly reserved that use. A reproduction made under the exception may be retained only for as long as the mining requires it.

Section 51b gives a library, archive, museum, school, or statutory depositary a separate, unconditional exception for text-and-data-mining carried out for research.