New legislation in the area of protection of personal data will enter into force on May 25, 2018. The new legislation – the General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 Coll. on Personal Data Protection – modifies to a significant degree the current rules applicable to personal data protection.

Companies operating in Slovakia should align their operations and procedures with the new legislative framework. This, in practice, means that, among other things, the following action should be taken:

• The current documentation related to personal data protection should be reviewed and, where required, amended so that it complies with the new rules. This means that, e.g., records of processing activities and consent forms should be updated.

• Contracts with data processors (such as with accounting firms or other third-party suppliers of services) should be reviewed and updated.

• It should be analyzed whether specific new obligations set forth in the new legislation (such as an obligation to designate a data protection officer, or an obligation to conduct a data protection impact assessment) will apply in the given circumstances.

• Cross-border transfers of personal data should be, where necessary, restructured so that they are in line with the new rules.

Slovak companies are highly advised to comply with the new legislation. Otherwise, there is a risk of high fines for non-compliance (up to EUR 20 million, or up to 4% of the total worldwide annual turnover).