GDPR for Companies — Complete Guide to Personal Data Protection under EU Regulation 2016/679

A frequent source of confusion is the relationship between the European regulation and Slovak law. Both apply simultaneously, but each serves a different purpose. Regulation 2016/679 (GDPR) is the superior, directly applicable instrument — it defines the principles, legal bases, rights of data subjects, obligations and the penalty framework. It is not a transposition; there is no 'Slovak version of GDPR'.

Act No. 18/2018 Coll. on the Protection of Personal Data complements GDPR in areas where the regulation leaves member states room for their own rules (so-called opening clauses) — the position of the supervisory authority, special rules for birth identification numbers, the age threshold for a child's consent or journalistic purposes. Act No. 18/2018 Coll. replaced the previous Act No. 122/2013 Coll. (which had itself replaced the older Act No. 428/2002 Coll.); both are no longer in force.

In practice this means: when you need the definition of the right to erasure or the deadline for reporting a breach, you open GDPR. When you are dealing with whether you may request a birth identification number or from what age a teenager's consent is valid, you open Act No. 18/2018 Coll.

To apply GDPR you need to understand four roles.

• Personal data — any information about an identified or identifiable natural person: name, e-mail, phone number, IP address, location data, photograph. Special categories (sensitive data) under Art. 9 GDPR are data concerning health, biometrics, genetics, religion, political opinions or sexual orientation — subject to a stricter regime.
• Data subject — the individual whose data is being processed: your customer, employee, supplier or website visitor.
• Controller — the party that determines the purposes and means of processing, typically your company. It bears the primary responsibility and faces the sanctions.
• Processor — processes data on behalf of the controller (an external accountant, payroll firm, IT provider, mailing service, cloud). The relationship must be governed by a processing agreement under Art. 28 GDPR.

The whole of GDPR rests on seven principles under Art. 5. They are the guardrails you must observe in every processing activity. Breaching them carries the highest tier of fines.

• Lawfulness, fairness and transparency — you process data only on a lawful basis, fairly and in a way that the person can clearly understand.
• Purpose limitation — you collect data for a specific, explicit and legitimate purpose and do not use it for an incompatible purpose.
• Data minimisation — you collect only the data that is genuinely necessary for the purpose. No 'just in case' collection.
• Accuracy — you keep data up to date and promptly correct or erase inaccurate data.
• Storage limitation — you retain data only for as long as necessary, then delete or anonymise it.
• Integrity and confidentiality — you adequately protect data against unauthorised access, loss or destruction.
• Accountability — you must be able to demonstrate compliance with the preceding six principles. It is not enough to comply; you need evidence.

It is precisely the seventh principle — accountability — that makes GDPR a system where 'we don't have anything written down but we comply' simply does not hold up. During an inspection the authority asks for documentation.

No processing is 'just because'. Every processing activity must have one of the six legal bases under Art. 6 GDPR:

• Consent of the data subject — a freely given, specific, informed and unambiguous expression of will; it must be revocable and demonstrable.
• Performance of a contract — when processing is necessary for the conclusion or performance of a contract (fulfilling an order, paying a salary).
• Legal obligation — when another law requires you to process the data (accounting, tax, archiving, BOZP (occupational health and safety) and occupational-health documentation).
• Vital interests — protection of the life and health of a person (rare, for example in healthcare).
• Public interest or exercise of official authority — typical for public authorities.
• Legitimate interests — a flexible basis (direct marketing to existing customers, network security, debt collection); requires a proportionality test (balancing test).

The most common company mistake: asking for consent for everything. In reality, consent is often the weakest and most fragile basis (it can be withdrawn at any time). For fulfilling an order or running payroll, consent is not needed at all.

GDPR gives individuals strong and enforceable rights. A company must respond to their exercise generally within one month (Art. 12 GDPR).

The practical consequence: you must have a working process for receiving requests, verifying the identity of the requester, locating the data and responding within the deadline. Ignoring a request is a common reason for a complaint to the authority.

In addition to principles and rights, GDPR imposes specific 'paperwork' obligations on a company. These are precisely what ÚOOÚ (Office for Personal Data Protection) checks first.

A Data Protection Officer (DPO) is an internal or external expert who oversees GDPR compliance, advises management and acts as the contact point for both data subjects and the authority. Under Art. 37 GDPR (and § 44 of Act No. 18/2018 Coll.) appointing one is mandatory in three cases:

• you are a public authority or a body governed by public law;
• your core activities consist of large-scale systematic monitoring of data subjects (large-scale tracking of behaviour, profiling);
• your core activities consist of large-scale processing of special categories of data under Art. 9 (for example, healthcare facilities).

Outside these cases a DPO is not mandatory, but many companies appoint one voluntarily because it simplifies demonstrating accountability. The DPO must have professional expertise, an independent position and sufficient resources. The role can be covered by an external provider (DPO outsourcing) — the most common solution for small and medium-sized companies.

A personal data breach is any security incident leading to the destruction, loss, alteration, unauthorised disclosure or access to data — from a lost USB drive through a hacked e-shop to an e-mail sent to the wrong recipient.

• Notification to the supervisory authority (Art. 33 GDPR, § 40 of Act No. 18/2018 Coll.) — you report the breach to the Office for Personal Data Protection of the Slovak Republic without undue delay, at the latest within 72 hours of becoming aware of it. The exception is where the breach is unlikely to result in a risk to the rights of persons.
• Notification to the data subject (Art. 34 GDPR) — if the breach is likely to result in high risk, you must without undue delay also inform the individuals concerned.

Every breach — including one that you do not report — must be documented internally. A prepared incident response plan (who decides, who reports, within what deadline) is the difference between a managed incident and a fine for a missed notification.

GDPR has one of the strictest penalty frameworks in the EU. Art. 83 GDPR distinguishes two tiers of fines depending on the seriousness of the violation.

The fine is set at whichever of the two amounts (fixed or percentage-based) is higher. In determining the amount, the authority takes into account the nature, seriousness and duration of the infringement, intent, cooperation and measures taken. Alongside fines it may impose corrective measures including a temporary or permanent ban on processing. In Slovak practice fines have so far been lower than the European maxima, but the number of ÚOOÚ decisions is growing.

The supervisory authority in Slovakia is the Office for Personal Data Protection of the Slovak Republic (ÚOOÚ), website dataprotection.gov.sk. Beware of a widespread misconception: GDPR is not enforced by the district office or the labour inspectorate — exclusively by ÚOOÚ.

The authority receives and handles complaints from data subjects, carries out inspections (on its own initiative and on a complaint basis), receives breach notifications and imposes fines. An inspection most commonly starts following a complaint by a customer or an employee. During an inspection the authority requests precisely the documentation — records of processing activities, privacy policies, consents, processing agreements and evidence of measures. A company whose documentation is in order will pass an inspection without major issues.

The following procedure summarises how a company gets from zero to a state of GDPR compliance.

• 'We are a small company, GDPR doesn't apply to us.' It applies to everyone who processes personal data. Size affects the scope of obligations, not their existence.
• 'I need consent for everything.' Consent is just one of six legal bases and is often not appropriate. Fulfilling an order or running payroll does not require consent.
• 'GDPR prohibits sending a newsletter to customers.' Direct marketing to existing customers can be based on legitimate interest, with the option to object at any time.
• 'Having a sentence about data protection on the website is enough.' The information obligation is just one of the documents required. Without records, agreements and measures you are not compliant.
• 'GDPR and records management are the same thing.' They are not. Records management is a separate area governed by Act No. 395/2002 Coll. and GDPR does not replace it.
• 'Fines are issued by the district office.' Sanctions under GDPR are imposed exclusively by ÚOOÚ.
• 'If nobody reports us, nothing happens.' The authority can act on its own initiative and you must be able to demonstrate accountability at any time.

Before a customer approaches you with a request or the authority with an inspection, go through this checklist:

• Do you have up-to-date records of processing activities?
• Are there clear and understandable Privacy Policies on your website and in your contracts?
• Do you have a legal basis identified for each processing activity?
• Are consents (marketing, cookies) demonstrable and revocable?
• Do you have signed processing agreements with all suppliers?
• Do you have technical and organisational measures and access controls in place?
• Do you know whether you need a DPO and whether you have carried out a DPIA for high-risk processing?
• Do you have a process for handling data subject rights within the deadline and a breach response plan within 72 hours?
• Have your employees been trained?