Content type · 25 documents in this view · 3,811 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Slovenia (25) Clear filter
Filter by Topic Supervisory Authorities 3587 Processing 2635 Personal Data 2394 Controllers 2017 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
IP Slovenia: Controller breached Art. 15(1)(d) and 15(3) GDPR by denying storage info and The data subject made an access request asking for (i) a copy of their personal data processed by the controller and (ii) information on the envisaged storage period of this data.… 0602-68/2025/18 · ·Art. 12, 15 Sep 8, 2026
€5,320 Slovenian DPA fines controller €5,320 for leaving employee personal data documents Paper documents containing the personal data of employees (the data subjects) were meant to be destroyed at a company (the controller). The personal data in these documents… Slovenia · ·Art. 5, 32 Sep 1, 2026
€1,282 IP-RS · 0609-41/2026/7 A company (the controller) used a service provider (the processor) to store personal data, manage a database, and provide technical support and maintenance on its behalf. A legal… Slovenia ·Art. 28
€1,198 A company (the controller) operates an online store An employee of the controller used a pirated and unlicensed software when creating the website. This software contained malicious code, which allowed a third person to access the… 0609-36/2026/7 ·Slovenia · Jul 8, 2026
€2,802 IP-RS · 0609-42/2026/7 A processor was contracted by a company (the controller) to maintain an online store, fix errors, and provide support. This included ensuring that the controller had installed the… Slovenia ·Art. 32 May 1, 2026
€6,600 Utility Company: Insufficient legal basis for data processing Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Utility Company €6,600 on 2026-04-15 for: Insufficient legal basis for data processing. Slovenia · ·Art. 5 Apr 15, 2026
€13,491 Legal Person: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Legal Person €13,491 on 2026-03-27 for: Insufficient technical and organisational measures to ensure information… Slovenia · ·Art. 32 Mar 27, 2026
Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access A controller, not named in the original decision but presumed to be a public institution, notified the Slovenian DPA after experiencing a data breach in relation to its website.… 0612-91/2025/40 ·Slovenia · Mar 4, 2026
€5,500 Slovenia DPA: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined an unnamed party €5,500 on 2026-02-16 for: Insufficient technical and organisational measures to ensure… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Feb 16, 2026
€4,850 Slovenia DPA: Insufficient technical and organisational measures to ensure information security Slovenian Supervisory Authority (Informacijski pooblaščenec) fined an unnamed party €4,850 on 2026-01-20 for: Insufficient technical and organisational measures to ensure… ·Art. 25 ·Insufficient technical and organisational measures to ensure information security Jan 20, 2026
€5,000 Sole Trader: Non-compliance with general data processing principles Slovenian Supervisory Authority (Informacijski pooblaščenec) fined Sole Trader €5,000 on 2026-01-06 for: Non-compliance with general data processing principles. Slovenia · ·Art. 5 Jan 6, 2026
€1,282 Unknown legal entity: Insufficient data processing agreement The Slovenian Supervisory Authority (Informacijski pooblaščenec) fined an unnamed legal entity €1,282 for maintaining an insufficient data processing agreement. The enforcement… Slovenia · ·Art. 28 Jan 1, 2026
€75,474 Legal Entity: Insufficient legal basis for data processing The Slovenian DPA has imposed a fine of EUR 75,474 on a legal entity. Without a sufficient legal basis, the controller installed software on an employee's work computer which… SLOVENIA · ·Art. 5, 6 Dec 11, 2025
€5,100 Legal Entity: Insufficient fulfilment of data subjects rights The Slovenian DPA has imposed a fine of EUR 5,100 on a legal entity. The controller operated a website where natural persons could fil in their personal data in a form. The… SLOVENIA · ·Art. 12, 13 Dec 8, 2025
€1,300 Legal Entity: Insufficient technical and organisational measures to ensure information security The Slovenian DPA has imposed a fine of EUR 1,300 on a legal entity. An employee of the controller stored personal data on her work laptop without securing it, for example by… SLOVENIA · ·Art. 32 Dec 4, 2025
€6,600 Legal Entity: Insufficient legal basis for data processing The Slovenian DPA has imposed a fine of EUR 6,600 on a legal entity. The controller used GPS trackers to systematically and indiscriminately monitor its employees' activities… SLOVENIA · ·Art. 5, 6 Nov 26, 2025
€16,650 Legal Entity: Insufficient technical and organisational measures to ensure information security The Slovenian DPA has imposed a fine of EUR 16,650 on a legal entity. The controller stored personal data on a publicly accessible web server without taking sufficient technical… SLOVENIA · ·Art. 32 Nov 21, 2025
€500 Sole Trader: Insufficient cooperation with supervisory authority The Slovenian DPA has imposed a fine of EUR 500 on a sole trader. The controller failed to react to a request by the DPA within the set 10-day period. SLOVENIA · ·Art. 31 Aug 13, 2025
€11,614 Legal Entity: Insufficient legal basis for data processing The Slovenian DPA has imposed a fine of EUR 11,614 on a legal entity. The controller did not delete the email address of a former employee, but rather continued to receive and… SLOVENIA · ·Art. 5, 6 Jul 29, 2025
€5,810 Legal Entity: Insufficient data processing agreement The Slovenian DPA has imposed a fine of EUR 5,810 on a legal entity. The controller employed a person authorised to perform clerical work. However, this person used a data… SLOVENIA · ·Art. 28 Jul 25, 2025
€5,020 Legal Entity: Insufficient technical and organisational measures to ensure information security The Slovenian DPA has imposed a fine of EUR 5,020 on a legal entity. The controller had developed an application that allowed the exchange of personal data, but failed to… SLOVENIA · ·Art. 32 Jul 25, 2025
€2,200 Legal Entity: Insufficient legal basis for data processing The Slovenian DPA has imposed a fine of EUR 2,200 on a legal entity. An employee of the company forwarded health data to a lawyer without sufficient grounds. The company was fined… SLOVENIA · ·Art. 6, 9 Jul 22, 2025
€16,000 Sole Trader: Insufficient legal basis for data processing The Slovenian DPA has imposed a fine of EUR 16,000 on a sole trader. The controller rented out apartments to tenants and installed video surveillance inside them. SLOVENIA · ·Art. 5, 6 May 14, 2025
€1,000 Sole Trader: Insufficient legal basis for data processing The Slovenian DPA has imposed a fine of EUR 1,000 on a sole trader. The controller published personal data on a website without a legal basis and despite being subject to a… SLOVENIA · ·Art. 5 Apr 25, 2025
IP Slovenia: ZEKom-1 governs legal basis for NIJZ #StayHealthy SMS to users The IP received a request for an opinion concerning sending of an SMS message to users about the new #StayHealthy app created by the National Institute of Public Health (NIJZ).… 07121-1/2020/1570 · ·Art. 6, 58 Sep 11, 2020