Slovenia Personal Data Protection Act (ZVOP-2)
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | SI ZVOP-2 |
| Region | Europe |
| Country or scope | Slovenia |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers SI ZVOP-2
- Scan requirements: 7, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
SI-ZVOP2-A32 Security of Processing | Technical and organisational measures appropriate to the risk must safeguard systems that process personal data; verifiable integrity hashes on deployed software components evidence this control (GDPR Art. 32, as given effect in Slovenia by ZVOP-2). | Scan |
SI-ZVOP2-A5F Integrity and Confidentiality Principle | Personal data must be processed in a manner ensuring its security and integrity, which requires the processing software stack to consist of components with known, assessable versions (GDPR Art. 5(1)(f), applied alongside ZVOP-2). | Scan |
SI-ZVOP2-A30 Records of Processing Systems | Controllers and processors must maintain records of processing activities, which presupposes an inventory of the software systems and components through which personal data flows (GDPR Art. 30; ZVOP-2). | Scan |
SI-ZVOP2-A28 Processor and Vendor Accountability | Processing carried out on behalf of a controller may only use processors offering sufficient guarantees, so third-party software components in the processing chain must have identifiable suppliers (GDPR Art. 28; ZVOP-2). | Scan |
SI-ZVOP2-A33 Breach-Notification Readiness | Personal data breaches must be notified to the supervisory authority without undue delay and where feasible within 72 hours, which requires affected software components to be rapidly and unambiguously identifiable (GDPR Art. 33; ZVOP-2). | Scan |
SI-ZVOP2-22 Processing Logs and Traceability | For higher-risk automated processing, the law mandates processing logs that record what was done to personal data and when; an SBOM with a document identifier and creation timestamp is the analogous traceability record for the software estate (ZVOP-2 Art. 22). | Scan |
SI-ZVOP2-23 Security of Special Processing | Large-scale 'special processing' information systems face heightened security duties linked to the Information Security Act, requiring complete knowledge of the software running in them, with every component named and versioned (ZVOP-2 Art. 23). | Scan |
Policy templates
All 22 from the standard set, adapted to SI ZVOP-2.
Slovakia Act No. 18/2018 on Personal Data Protection
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Spain ENS (RD 311/2022)
Esquema Nacional de Seguridad - Spanish national security framework for public-sector systems.