Law: Personal Data Protection Act 2022 (only available in Slovenian here) (ZVOP-2)

Regulator: Information Commissioner (the Commissioner)

Summary: Slovenia was the last EU Member State to implement the GDPR, with the Personal Data Protection Act 2022 (only available in Slovenia here) (ZVOP-2) entering into force on January 26, 2023, thereby replacing the Personal Data Protection Act 2004.

ZVOP-2 introduces provisions regarding the processing of personal data in relation to special category data, biometric data, personal data processed for marketing purposes, alongside traceability logs for controllers processing large amounts of sensitive personal data.

The Information Commissioner is an active regulator that has published several guidelines on various topics, including cookies, website privacy policies, data protection officer appointment, and data transfers.