Office for Personal Data Protection

What it means

The Office for Personal Data Protection of the Slovak Republic is the independent supervisory authority overseeing compliance with the GDPR and the Slovak Data Protection Act. It is part of the European network of supervisory authorities and in cross-border cases cooperates with authorities of other EU states within the European Data Protection Board.

The Office receives and handles complaints from data subjects, carries out inspections of controllers and processors, receives notifications of personal data breaches, issues guidance and opinions, and imposes corrective measures and fines. GDPR fines can reach tens of millions of euros or a percentage of worldwide turnover.

The contact details of a data protection officer are also notified to the Office if the company has appointed one, whether mandatorily or voluntarily. For high-risk processing that cannot be sufficiently mitigated even after an impact assessment, the controller must consult the Office in advance.

How it works in practice

The most common contact a company has with the Office is notifying a data breach, such as a leaked database, data sent to the wrong recipient or a lost laptop. If the breach is likely to pose a risk to people's rights, the controller must notify it within 72 hours of becoming aware. Where the risk is high, the data subjects must be informed too.

If the Office opens proceedings following a complaint, the company is asked to respond and provide documentation. What matters is being able to demonstrate compliance: records of processing, legal bases, processor agreements, security measures and procedures for data subject requests. A company with its documentation in order is in a much stronger position.

The Office publishes guidance on common topics such as CCTV, employee monitoring and cookies. It is worth following, as it shows how the Office interprets the rules. Where things are unclear, it is better to proceed cautiously and have the approach assessed before processing begins.

What to watch out for

The most common mistake with a data breach is concealing it or notifying late. The company hopes the leak will go unnoticed and the 72-hour deadline passes. Failure to notify is a separate GDPR breach and, if later discovered, significantly worsens the company's position. Even an incomplete initial notification is better than none.

Beware of fraudulent emails and letters posing as the Office and demanding payment for registration or a GDPR compliance check. The Office charges no registration fees and imposes fines by decision in administrative proceedings. If in doubt, verify the communication through the Office's official contacts.