# Slovenian DPA fines controller €1,282 for missing Art. 28(3) processor contract - Type: Enforcement - Source: IP (Slovenia) - Date: 2026-08-11 - Original: https://gdprhub.eu/index.php?title=IP_(Slovenia)_-_0609-41/2026/7 - Canonical: https://overview.legal/posts/262256 - Topics: Controllers, Processors, Processing Agreement, Representatives, Processing, Personal Data, Supervisory Authorities, Data Processor, Recipient, Supervision ## Summary Facts — A company (the controller) used a service provider (the processor) to store personal data, manage a database, and provide technical support and maintenance on its behalf. A legal representative of the controller, who was responsible for ensuring that the controller complied with the GDPR, had not concluded a valid contract defining the contractual relationship with the processor, regulating the processing operations entrusted to it. Holding — The DPA held that the controller had violated Article 28(3) GDPR and issued the controller a fine of €1,282. It concluded that the legal representative of the controller had failed to properly conclude the contractual relationship with the processor: the processing operations carried out by the processor were not governed by a contract or other legal act in accordance with EU or Member State law, setting out the obligations of the processor. As the representative acted in the performance of their duties as an employee and on behalf of the controller, the DPA held that the controller was liable for the infringement as the responsible legal entity. ## Full text 1 Number: 0609-41/2026/7 Date: … The Information Commissioner (hereinafter: the administrative authority), through the authorized official …, acting in an official capacity, hereby issues, pursuant to the second paragraph of Article 51 and Article 46 of the Minor Offenses Act (Official Gazette of the Republic of Slovenia, No. 29/11—consolidated text, 21/13, 111/13, 74/14 – Constitutional Court Decision, 92/14 – Constitutional Court Decision, 32/16, 15/17 – Constitutional Court Decision, 73/19 – Constitutional Court Decision, 175/20 – ZIUOPDVE, 5/21 – Constitutional Court Decision, 38/24, 100/25 – ZS-1 and 10/26; hereinafter: ZP-1) and Articles 2 and 8 of the Information Commissioner Act (Official Gazette of the Republic of Slovenia, Nos. 113/05 and 51/07 – ZUstS-A) in the proceedings concerning an administrative offense committed by the legal entity …, for an offense under the first paragraph of Article 95 of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, 40/25 – ZInfV-1 and 10/26 – ZP-1L, hereinafter: ZVOP-2) in conjunction with point (a) of the fourth paragraph of Article 83 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: the General Regulation), the following DECISION ON AN ADMINISTRATIVE OFFENSE The offending legal entity: …, is liable for an administrative offense under the first paragraph of Article 95 of ZVOP-2 in conjunction with point (a) of the fourth paragraph of Article 83 of the General Regulation, which was committed in the period from … to … in … by …, in that, as the legal representative of the legal entity—in which he served as its …—he was obligated to ensure that the legal entity operated in accordance with the General Regulation, the ZVOP-2, and the legal entity’s internal regulations, failed to properly regulate the contractual relationship with the personal data processor, the company …, which provided the service … to the legal entity …, under which, for the purpose of storing personal data, managing the database, and providing technical support and maintenance on behalf of and for the account of the legal entity …, it processed the personal data of employees of the legal entity (…), since during the period from … to …, it failed to ensure the conclusion of a valid contract defining the contractual relationship with the processor and regulating the processing by the processor, as required by the third paragraph of Article 28 of the General Regulation, thereby violating the obligation under the third paragraph of Article 28 of the General Data Protection Regulation, which requires that processing by a processor be governed by a contract or other legal act in accordance with Union law or the law of a Member State, which sets out the obligations of the processor in relation to the processing of personal data carried out on behalf of the controller. The offender … committed the offense while performing his or her duties and on behalf of and using the resources of the legal entity …, where he or she was employed as … at the time the offense was committed; consequently, the legal entity … is liable for the aforementioned offense as the responsible legal entity in accordance with the first paragraph of Article 14 of the ZP-1. 2 The legal entity liable for the offender is therefore, pursuant to the first paragraph of Article 95 of ZVOP-2 in conjunction with point (a) of the fourth paragraph of Article 83 of the General Regulation and in application of the third paragraph of Article 52 of the ZP-1, Article 115 of the ZVOP-2, the first and second paragraphs of Article 83 of the General Regulation, and the second paragraph of Article 26 of the ZP-1 for the administrative offense is hereby A FINE in the amount of 1,282 EUR. The offending legal entity must pay the fine in the amount of 1,282 euros to the recipient’s account: Information Commissioner, Recipient’s IBAN: SI56 0110 0845 0051 825, Recipient’s bank BIC code: BSLJSI2X, purpose code: GOVT, payment purpose: 0609-41/2026/7 fine, reference: SI11 12157-7120010-202659. The offending legal entity … must, pursuant to the first paragraph of Article 143 in conjunction with the first paragraph of Article 144 and the second paragraph of Article 58 of ZP-1, pay a court fee in the amount of 128 euros. The court fee, which is assessed against the violator for the imposed fine under tariff number 8111 of the ZST-1, must be paid by the violator, as the liable legal entity, to the recipient’s account: Information Commissioner, Recipient’s IBAN: SI56 0110 0845 0162 502, Recipient’s bank BIC code: BSLJSI2X, purpose code: GOVT, payment purpose: 0609-41/2026/7 court fee, reference: SI11 12157-7120087-202660. The offender must pay the full amount of the imposed fine and the court fee within fifteen (15) days after the decision on the administrative offense becomes final. After the payment deadline has expired, the offender may apply to the authority responsible for enforced collection (the Financial Administration of the Republic of Slovenia) to pay the fine and procedural costs (court fees) in installments. If the offender fails to pay the fine and the costs of the proceedings (court fees) within the specified time limit, the unpaid fine and costs of the proceedings (court fees) will be collected by enforcement. LEGAL NOTICE: A request for judicial review may be filed against this decision on an administrative offense. The request must be submitted in writing within eight days of receipt of this decision to the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana; otherwise, the person entitled to file the appeal (the offender, legal representative, or defense counsel) shall be deemed to have waived the right to seek judicial review. The notice of the request must be sent by mail or delivered in person in two copies and is considered timely if it is submitted on the last day of the deadline for filing the notice of the request, either by certified mail or in person to the authority that issued the decision. A notice of intent to file a request for judicial protection may be withdrawn until the deadline for filing such a notice has expired. If a person entitled to file a request for judicial protection fails to give notice of such a request within the statutory deadline or withdraws the notice, they are deemed to have waived their right to file a request for judicial protection. If none of the persons entitled to file a request for judicial protection gives such notice, the administrative authority shall not issue a decision on the administrative offense with a statement of reasons; instead, a final decision without a statement of reasons shall be deemed to have been served on the date of service of the decision, and such decision shall become final upon the expiration of the deadline for filing a request for judicial review. If at least one of the parties entitled to file a request for judicial review announces the filing of such a request, a written decision on the administrative offense, including a statement of reasons, shall be issued and sent no later than 30 days after receipt of the notice of intent to file a request for judicial review. In this case, the reasoned decision shall be served on all persons entitled to file a request for judicial review. 3 An offender who does not give notice of an appeal against the decision on the administrative offense shall pay half the amount of the fine within eight days after the expiration of the deadline for giving notice of the appeal (half the amount of the fine is 641 euros); otherwise, they must pay the full amount of the imposed fine within the time limit specified in the operative part of this decision. Within the same time limit specified in the operative part of this decision, an offender who files a notice of intent to seek judicial review of the decision but subsequently fails to file a written appeal against the decision must also pay the full amount of the fine imposed. If the violator pays half of the fine before the deadline for filing a request for judicial review expires, the request for judicial review of the decision is not permitted, except in cases where the offender was required to pay the fine before the expiration of the deadline for filing the request in accordance with the provisions of ZP-1. Under the conditions and in accordance with the regulations governing the financial operations of the administrative offense authority, the offender may also pay the fine and procedural costs using a non-cash payment method. Authorized Official: …, State Supervisor for Personal Data Protection Attachment: - Official note on the calculation of the fine amount. - Letter …. To be served: − … – by certified mail pursuant to the Administrative Procedure Act (ZUP), with attachment. ## Cited law provisions (1) ### GDPR — gdpr-art-28-par-3-en Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: --- Generated by overview.legal · https://overview.legal/posts/262256 · 2026-08-22