GDPR – Personal Data Protection
Our company provides comprehensive personal data protection (GDPR) for businesses, sole traders, e-shops and their premises across Slovakia — from drawing up documentation and records of processing through consents and impact assessment to the role of the data protection officer (DPO). Everything is handled in accordance with Regulation (EU) 2016/679 and Act No. 18/2018 Coll., so your company passes Data Protection Authority checks without issues and avoids penalties.
Interested in this service?
Leave us your contact and we will get back to you with pricing and dates, usually within 24 hours.
Turnkey GDPR for companies — we handle it for you
Non-compliance with GDPR exposes a company to a fine of up to EUR 20 million or 4% of total worldwide annual turnover (čl. 83 ods. 5 of Regulation (EU) 2016/679), whichever is higher. And the obligations apply to practically every business that processes personal data — anyone who keeps employee records, sends invoices, runs an e-shop, collects contacts via a form, operates a CCTV system or sends out a newsletter.
In Slovakia, Regulation (EU) 2016/679 (GDPR) applies directly, supplemented by Act No. 18/2018 Coll. on personal-data protection. The scope of obligations does not depend on the size of the company — only the volume of documentation differs. Alpha Safety will sort out personal-data protection for you on a turnkey basis: you do not have to become an expert, we take over the entire agenda for you, from the audit through documentation and training to representation during an inspection.
Want to understand first what GDPR even is and how it works? Read our complete GDPR guide. This page is about how we solve it for you.
What a company risks if it fails to comply with GDPR
Non-compliance with GDPR is not just a paperwork formality — it has three concrete consequences: fines, an inspection by the authority and reputational damage.
| Fine tier | Amount | Legal basis |
|---|---|---|
| Lower tier (e.g. records, DPO, security) | up to EUR 10 million or 2% of total worldwide annual turnover | čl. 83 ods. 4 GDPR |
| Higher tier (principles, rights of individuals, transfers) | up to EUR 20 million or 4% of total worldwide annual turnover | čl. 83 ods. 5 GDPR |
The higher of the two values always applies (the amount or the percentage of turnover). You will find a detailed analysis of sanctions, inspections and the role of the authority in the GDPR guide — on this page we will show you how to avoid the risk.
The supervisory authority is neither the district office nor the labour inspectorate, but the Office for Personal Data Protection of the Slovak Republic (ÚOOÚ). An inspection most often arises on the basis of a complaint — for example from a dissatisfied customer or a former employee — and during it the authority asks precisely for the documentation. We therefore tackle the most common breaches first: missing documentation, failure to fulfil the information obligation, processing without a legal basis and unsecured data.
What we will arrange for you — turnkey GDPR
We take over the entire agenda for you — from the first audit to representation during an inspection. On a contracted basis we cover the whole lifecycle of GDPR compliance.
Entry audit and gap analysis
We map what personal data you process, for what purposes and on what legal basis (čl. 6 GDPR), who has access to it and to whom you provide it. The result is an overview of gaps and a specific list of what needs to be added or corrected. The audit is the starting point for everything else.
Complete tailor-made GDPR documentation
We will prepare the whole package of documents tailored to your activity, not generic templates from the internet:
- records of processing activities (čl. 30 GDPR),
- information obligations for customers, employees and applicants (čl. 13–14 GDPR),
- consents and internal data-protection directives,
- processor agreements with suppliers (accountant, IT, marketing, cloud) under čl. 28 GDPR,
- procedure for data-subject requests and for a personal-data breach,
- where necessary, a data protection impact assessment (DPIA) under čl. 35 GDPR and § 42 of Act No. 18/2018 Coll.
Outsourced data protection officer (DPO)
If the law requires you to have a responsible person / DPO (čl. 37 GDPR, § 44 of Act No. 18/2018 Coll.) — or you want to have one voluntarily — we take over this function externally. We are the point of contact for the authority and for data subjects, we oversee compliance and provide ongoing advice. Outsourcing the DPO is cheaper and more reliable than training and maintaining your own employee.
Employee training and representation during an inspection
The weakest link is usually the human — we will train your team in how to handle data, respond to requests and recognise and report a breach. And when an inspection or a request from the ÚOOÚ arrives, you will not be left to face it alone: we prepare the materials, communicate with the authority on your behalf and help you manage the proceedings so as to minimise the risk of a sanction.
What type of company the service is intended for
We tailor turnkey GDPR to the type of operation. Most often we handle it for:
- E-shops and online services — consents, cookies, newsletter, processing of orders and complaints, profiling.
- Employers and HR — personnel and payroll agenda, attendance, cameras, monitoring of employees (§ 13 ods. 4 of the Labour Code).
- IT companies and agencies that act as processors and need both contracts and guarantees for their clients.
- Small companies and self-employed persons with employees who want order without building an internal department.
- Healthcare, social and educational entities that process special categories of data (čl. 9 GDPR) and are subject to a stricter regime.
Not sure which category you belong to? Tell us what you do, and we will determine the scope — the audit will show it precisely.
How cooperation with Alpha Safety works
We have set up the cooperation so that it burdens you as little as possible. The first contact and assessment are non-binding.
Non-binding enquiry and consultation You get in touch via the form or by phone. We briefly establish the type of your activity and propose the scope. The consultation is free and non-binding.
Entry audit and price quote We map the processing of personal data, identify the gaps and send you a fixed price quote based on the actual scope — no hidden items.
Preparation of tailor-made documentation We prepare a complete package of documents, directives and contracts tailored to your operation and hand it over ready for use.
Training and rollout We train the responsible staff, explain the procedures and set up the processes: data-subject requests, breach reporting, processor relationships.
Ongoing support and representation We take over the DPO function (if needed), update the documentation when legislation changes and represent you during an ÚOOÚ inspection. Compliance is not a one-off — we maintain it with you over the long term.
The canonical GDPR articles that concern you
For orientation, we list the most important provisions that we cover within the service. You do not have to remember them — that is our job.
| Area | Article / § | What it governs |
|---|---|---|
| Principles of processing | čl. 5 GDPR | 7 principles (lawfulness, purpose, minimisation, accuracy, storage, integrity, accountability) |
| Legal bases | čl. 6 GDPR | consent, contract, law, vital/public/legitimate interest |
| Information obligation | čl. 13–14 GDPR | what you must communicate to the data subject |
| Rights of the data subject | čl. 15–22 GDPR | access, rectification, erasure, restriction, portability, objection |
| Records of activities | čl. 30 GDPR | records of processing activities |
| Responsible person (DPO) | čl. 37 GDPR, § 44 z. 18/2018 | when appointing a DPO is mandatory |
| Impact assessment (DPIA) | čl. 35 GDPR, § 42 z. 18/2018 | where there is a high risk to the rights of individuals |
| Notification of a breach to the authority | čl. 33 GDPR, § 40 z. 18/2018 | reporting to the ÚOOÚ within 72 hours |
| Sanctions | čl. 83 GDPR | up to EUR 10 million/2% or EUR 20 million/4% |
| Monitoring of employees | § 13 ods. 4 of the Labour Code | conditions for monitoring employees |
How much turnkey GDPR costs
The price depends on the scope — the number of processing activities, the type of operation and whether you need one-off documentation or long-term DPO outsourcing. We agree the entry audit at the outset and its output is the basis for a precise quote; turnkey documentation is charged as a one-off, DPO outsourcing as a monthly flat fee.
After a non-binding consultation you receive a fixed quote with no hidden items. Bear in mind that a single fine from the ÚOOÚ exceeds the cost of compliance many times over — turnkey GDPR is insurance, not an extra expense. Get a non-binding quote.
Why Alpha Safety — GDPR and safety under one roof
Most providers handle only GDPR. We handle the company's entire compliance from one place — that is our main difference.
- One partner, one invoice — you run GDPR together with BOZP, fire protection, the occupational health service and civil protection. No juggling several suppliers.
- A practical approach, not just paper — we set up the documentation so that it works in real operation, not so that it sits in a drawer.
- Representation during an inspection — during an inspection by the authority you are not alone, we conduct the communication on your behalf.
- Long-term maintenance — legislation changes, and we keep your documentation up to date.
- Local availability across Slovakia — we operate in all regional and district towns.
Our services in the field of GDPR
Documentation preparation
Preparation of GDPR documentation and necessary internal guidelines.
Processing purpose analysis
Analysis of personal data processing purposes.
Information obligation
Design of information obligations towards data subjects.
Contracts with processors
Preparation of contracts with processors and other entities.
Training
Training of authorized persons and responsible employees.
Consulting and services
Providing consulting and services even after documentation delivery.
DPO services
Data Protection Officer (DPO) services and ongoing support.
Why work with us?
- Expert knowledge of GDPR regulation
- Comprehensive custom solutions
- Prevention of fines up to €20 million
- Regular documentation updates
- Support during data protection authority inspections
Stručná odpoveď
GDPR – personal-data protection is a company's compliance with Regulation (EU) 2016/679 and Act No. 18/2018 Coll. on the protection of personal data. Alpha Safety prepares GDPR documentation and directives, analyses the purposes of processing, proposes information obligations and contracts with processors, trains employees, provides ongoing consultancy and performs the function of the data protection officer (DPO).
Časté otázky – GDPR
Preparing GDPR documentation and internal directives, analysing the purposes of processing personal data, proposing how to fulfil the information obligation towards data subjects, and preparing contracts with processors. It also includes employee training, ongoing consultancy and performing the function of the data protection officer (DPO).
Under § 44 ods. 1 of Act No. 18/2018 Coll., designating a data protection officer is mandatory for public authorities and for controllers whose core activity is the regular and systematic monitoring of data subjects on a large scale or the processing of special categories of data on a large scale. We will assess whether the obligation also applies to you and, if needed, provide the function.
Under Article 83(5) of Regulation (EU) 2016/679, a fine may reach up to EUR 20,000,000, or in the case of an undertaking up to 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher. Correctly set up GDPR substantially reduces this risk.
Under § 42 of Act No. 18/2018 Coll., the controller must carry out an impact assessment if the type of processing, in particular using new technologies, is likely to result in a high risk to the rights of natural persons. As part of the analysis we will assess whether a DPIA applies to your processing and help to prepare it.
The processing of personal data in the Slovak Republic is governed by the directly effective Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the protection of personal data. Act No. 18/2018 Coll. also governs the position and competence of the Office for Personal Data Protection of the Slovak Republic, which supervises compliance with the rules.
Yes. We provide support during inspections by the supervisory authority, prepare the necessary documentation and communication and are available as a consultant throughout the process. The aim is to demonstrate that your data processing complies with the GDPR and with Act No. 18/2018 Coll.
For companies and organisations of all sizes that process the personal data of employees, customers or partners. We adapt the scope of the service according to what data you process, for what purposes and to what extent, so the solution suits a small company as well as a larger organisation.
The tasks of the data protection officer are governed by § 46 of Act No. 18/2018 Coll. The data protection officer in particular provides advice on data-protection obligations, monitors compliance with the regulations and serves as a point of contact for the supervisory authority and data subjects. We provide ongoing assistance in performing this function.
Yes. GDPR applies to anyone who processes the personal data of natural persons, regardless of size. If you keep records of employees, customers, suppliers or contacts from a form, you have obligations. Only the scope of the documentation differs, not the obligation itself.
If a data breach poses a risk, it is reported to the Office for Personal Data Protection generally within 72 hours under Article 33 of Regulation (EU) 2016/679 and § 40 of Act No. 18/2018 Coll., and in serious cases also to the data subject (Article 34). We will set up the procedure so that you can respond in time.
Yes. E-shops additionally deal with consents, cookies and tracking tools, newsletters, the processing of orders and complaints, and possibly profiling. We set up these areas as a priority for e-shops, including processor contracts with suppliers.
We do not recommend it. Generic templates do not take account of your specific processing and rarely stand up at an inspection. We prepare the documentation tailored to what and why you actually process.
Only under set conditions and after fulfilling the information obligation. Alongside GDPR, the monitoring of employees is also governed by § 13 ods. 4 of the Labour Code. We will help you set it up so that it complies with the regulations.
No. GDPR addresses the protection of personal data, whereas the management of records is governed by a separate Act No. 395/2002 Coll. on archives and registries. These are two different agendas, although they partly overlap, and we can cover both.
Write to us — we'll get back to you within one business day
Leave us your contact details and we'll get back to you — no commitment.
Need help with GDPR?
Contact us for a free consultation. We'll propose a solution tailored to your needs.