What Is Act No. 18/2018 Coll. on Personal Data Protection?
Slovakia’s national privacy framework is Act No. 18/2018 Coll. The Act was approved on 29 November 2017, promulgated on 30 January 2018, and originally entered into force on 25 May 2018. Its current consolidated Slov-Lex version is effective from 18 August 2026, only ten days before 7 September 2026. The latest listed amendment is 168/2026, principally changing criminal-processing provisions. For GDPR-covered processing, GDPR is the primary directly applicable instrument. Section 3(2) provides that the Slovak Act applies except for its definitions and Parts II and III in that context, while Part IV and institutional, enforcement, and procedural provisions remain relevant. The Act’s §§19-30 mirror GDPR-style information, access, rectification, erasure, restriction, notification, portability, objection, and automated-decision rules for non-GDPR-covered contexts. A genuinely current public-record finding concerns Slovakia’s Commercial Register. The Office states that, in the 19 August 2026 official record, it had opened proceedings concerning publication of personal data in Commercial Register documents. The Office advises affected individuals to exercise access, erasure, and restriction rights against the Ministry of Justice, preserve evidence, and use the complaint route where appropriate. This is a live institutional response, not a general public-record or data-broker deletion right.
At a glance
- Full name
- Act No. 18/2018 Coll. on Personal Data Protection
- Short code
- Act No. 18/2018 Coll.
- Jurisdiction
- Slovakia
- Enacted
- 2018
- Last major update
- The current consolidated Slov-Lex text is effective from 18 August 2026; the latest listed amendment is 168/2026, principally changing criminal-processing provisions
- Regulator
- Office for Personal Data Protection
- Private right of action
- Limited
- Statutory citation
- Act No. 18/2018 Coll. on Personal Data Protection + GDPR
Scope, who Act No. 18/2018 Coll. covers
Protected data
Data subject rights
Right to information for direct and indirect collection, including controller, purpose, legal basis, recipients, transfers, and public-source origin
Right of access to personal data and related processing information
Right to rectification
Right to erasure subject to expression, legal-obligation, public-health, research, archiving, statistics, and legal-claims exceptions
Right to restriction of processing
Right to notification of recipients about rectification, erasure, or restriction
Right to data portability for subject-supplied data processed by automated means on consent or contract grounds, excluding public-task or official-authority processing
Right to object, including an absolute objection to direct marketing and a qualified objection for specified research or statistical processing
Safeguards against specified solely automated decisions, including human review and the ability to challenge
Right to complain to the Office for Personal Data Protection; the Office’s current guidance requires a signed written complaint, an authorized electronic submission, or an in-person submission, with controller identification, the affected rights, supporting evidence, and proof of the prior rights request where applicable
Right to exercise access, erasure, or restriction rights against the Ministry of Justice regarding relevant Commercial Register publications
Notable features
The current consolidated Slov-Lex text is unusually fresh, effective from 18 August 2026. Distinctive Slovak layering includes the rule that birth numbers are not GDPR special-category data, consent-free but qualified academic, artistic, literary, and media processing, research and archive restrictions, and a separate law-enforcement regime. The Commercial Register proceeding is current but does not establish a general deletion rule.
Enforcement & penalties
Regulator: Office for Personal Data Protection
Penalties: Section 104(1) permits fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher, for enumerated controller, processor, competent-authority, certification-body, and monitoring-body obligations. Section 104(2) permits up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches involving principles, data-subject rights, transfers, Section 78 lawful-processing rules, or Office orders. Section 105 provides separate procedural or cooperation fines of up to €2,000 or €10,000.
Private right of action: Office complaint, assessment, inspection, corrective-measure, and fine proceedings are the identified mechanisms. A separate Slovakia-specific private-action rule was not located in the reviewed materials; GDPR-covered processing remains subject to the directly applicable GDPR framework.
Relevance to data brokers
No Slovakia-specific statutory data-broker complaint, deletion, or registry route was located. The Office’s current guidance says to exercise rights first with the relevant controller; a complaint to initiate proceedings may then be made in writing, through an authorized electronic submission, or in person, with controller identification, the affected rights, supporting evidence, and proof of the prior rights request where applicable. Ordinary email must be completed through an authorized channel within three working days, and proceedings and decisions are in Slovak. For Commercial Register publications, the Office advises affected individuals to exercise access, erasure, and restriction rights against the Ministry of Justice and use the Office complaint route if appropriate. The Office’s August 2026 proceeding is specific to that register and is not a general data-broker removal right.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Which law applies to GDPR-covered processing in Slovakia?+
GDPR is the primary directly applicable instrument. Section 3(2) of Act No. 18/2018 Coll. provides that the Slovak Act applies except for its definitions and Parts II and III for GDPR-covered processing, while national institutional, enforcement, and procedural provisions remain relevant.
Does Slovakia have a dedicated data-broker deletion route?+
No Slovakia-specific statutory data-broker complaint, deletion, or registry route was located. For relevant Commercial Register publications, the Office advises affected individuals to exercise access, erasure, and restriction rights against the Ministry of Justice and use the Office complaint route where appropriate.
What does a complaint to the Slovak Office need to include?+
The Office’s current guidance requires a written, authorized electronic, or in-person complaint identifying the complainant and controller, the affected rights, supporting evidence, and proof that the relevant right was exercised with the controller where applicable. Ordinary email must be completed through an authorized channel within three working days; the proceeding and decision are in Slovak.
How long does the Slovak Office have to decide a proceeding?+
The Office states that it decides within 90 days from initiation, with an extension in reasonable cases up to a maximum of 180 days, with written notice of the extension.
What happened with Slovakia’s Commercial Register proceedings?+
The Office states that, in the 19 August 2026 official record, it had opened proceedings concerning publication of personal data in Commercial Register documents. The matter is an ongoing Office proceeding, not a final general deletion rule.
Official sources & citations
Other international privacy regimes
Act No. 18/2018 Coll. sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: