Page 1

To notify the designation of the responsible person and his contact details to the Office under the new legislation
According to Act no. 122/2013 Coll. on Personal Data Protection and on Amendments to Certain Acts
as amended by Act No. 84/2014 Coll. (hereinafter referred to as “Act No. 122/2013 Coll.”) , the operator was entitled to entrust
personal data protection supervision by the responsible person. The operator was within 30 days at the latest
obliged to inform the Office of this fact in writing, specifically about the data stipulated in § 25 par. 2 of the Act
no. 122/2013 Coll. According to § 25 par. 4 and § 26 of Act no. 122/2013 Coll. the operator was obliged to notify the Authority
change of the reported data, if any, as well as termination of the authorization of the responsible person.
The new legislation applicable from 25.05.2018 provides for situations where they are the operator
as well as the intermediary is obliged to designate a responsible person . If the operator and intermediary do not have
the obligation to designate a responsible person, but to designate a responsible person voluntarily, the provisions of Art. 37 - Art. 39
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to
processing of personal data and on the free movement of such data, repealing Directive 95/46 / EC
(General Data Protection Regulation) resp. § 44 - § 46 of Act no. 18/2018 Coll. on the protection of personal data
and amending certain acts (hereinafter referred to as “GDPR” and “Act No. 18/2018 Coll.”) also apply to such
operator and a responsible person voluntarily designated by him. In order to determine whether or not he has an obligation
the designation of the responsible person should be made by each operator (including one who already has a responsible person) as well as
the intermediary to carry out an analysis, which can then be part of, for example, the safety case. 1
In this way, the operator and the intermediary subsequently demonstrate how they came to the conclusion that they have resp.
they are not obliged to designate a responsible person.
Due to the above, the following situations may arise:
1. The operator who had an authorized person in accordance with Act no. 122/2013 Coll. based on the analysis
found that he was not obliged to have a designated responsible person under the new legislation, and
a. wants to continue to have this responsible person from 25.05.2018
• such a procedure is possible only if the current responsible person meets all the conditions
imposed on the responsible person according to the GDPR resp. Act no. 18/2018 Coll.
• provisions of Art. 37 - Art. 39 GDPR resp. § 44 § 46 of Act no. 18/2018 Coll. apply to
operator and the responsible person as if it had been compulsorily designated
• The operator is obliged to notify the Office of the contact details of the responsible person
person by means of a form published for that purpose by the Office on its
website, here: https://www.dataprotection.gov.sk/uoou/zo/register-zo; if you are
the operator fails to fulfill his legal obligation and does not notify the Office of the contact details
responsible person, information on the responsible person so far authorized by the Office
to 25.05.2018 will be removed from its records
• the operator notifies the Authority in order to fulfill the tasks of the contact point for the Authority
in connection with the performance of the Office's tasks, also the identification data of the responsible person
within:
1. natural person - title, name, surname
2. legal entity - name, identification number
• the operator is obliged to draw up (appoint) the responsible person in accordance with
new legislation
b. does not want to have this responsible person from 25.05.2018 onwards
• the operator does not have to take any action; in this case, the Office as of 25.05.2018
it automatically removes from its records information about the responsible person against whom you are
the operator has not fulfilled the obligation to communicate the contact details of the responsible person

1

Guideline of the WP29 working group on responsible persons

Page 2

2. The operator who had an authorized person in accordance with Act no. 122/2013 Coll. based on the analysis
found that he has an obligation to have a designated responsible person under the new legislation, and
a. he wants to keep the person he had responsible
• such a procedure is possible only if the current responsible person meets all the conditions
imposed on the responsible person according to the GDPR resp. Act no. 18/2018 Coll.
• the operator is obliged to notify the Office of the contact details of the responsible person ,
by means of a form published for that purpose by the Office on its website,
here: https://www.dataprotection.gov.sk/uoou/zo/register-zo; if the operator fails to comply
its legal obligation and does not notify the Office of the contact details of the responsible person,
information on the responsible person so far authorized by the Office as of 25.05.2018 will be removed from its
records
• the operator notifies the Authority in order to fulfill the tasks of the contact point for the Authority
in connection with the performance of the Office's tasks, also the identification data of the responsible person
within:
1. natural person - title, name, surname
2. legal entity - name, identification number
• the operator is obliged to draw up (appoint) the responsible person in accordance with
new legislation
b. he does not want to keep the responsible person he had and appoint a new one
• the new responsible person must meet all the conditions imposed on the responsible person
according to GDPR resp. Act no. 18/2018 Coll.
• the operator is obliged to notify the Office of the contact details of the responsible person ,
by means of a form published for that purpose by the Office on its website,
here: https://www.dataprotection.gov.sk/uoou/zo/register-zo ;
• the operator notifies the Authority in order to fulfill the tasks of the contact point for the Authority
in connection with the performance of the Office's tasks, also the identification data of the responsible person
within:
1. natural person - title, name, surname
2. legal entity - name, identification number
• the operator is obliged to draw up (appoint) the responsible person in accordance with
new legislation
3. An operator who did not have an authorized person under Act no. 122/2013 Coll. based on
analysis found that he was not obliged to have a designated responsible person under the new legislation, but
voluntarily
a. wants to designate a responsible person
• the responsible person must meet all the conditions imposed on the responsible person under
GDPR resp. Act no. 18/2018 Coll.
• provisions of Art. 37 - Art. 39 GDPR resp. § 44 § 46 of Act no. 18/2018 Coll. apply to
operator and the responsible person as if it had been compulsorily designated
• the operator is obliged to draw up (appoint) the responsible person in accordance with
new legislation
• the operator is obliged to notify the Office of the contact details of the responsible person ,
by means of a form published for that purpose by the Office on its website,
here: https://www.dataprotection.gov.sk/uoou/zo/register-zo
• the operator notifies the Authority in order to fulfill the tasks of the contact point for the Authority
in connection with the performance of the Office's tasks, also the identification data of the responsible person
within:

Page 3

1. natural person - title, name, surname
2. legal entity - name, identification number
b. does not want to designate a responsible person
• The operator does not take any action
4. Operator who did not have an authorized person according to Act no. 122/2013 Coll. based on
analysis found that he has an obligation to have a designated responsible person under the new legislation
• the responsible person must meet all the conditions imposed on the responsible person under
GDPR resp. Act no. 18/2018 Coll.
• the operator is obliged to draw up (appoint) the responsible person in accordance with
new legislation
• the operator is obliged to notify the Office of the contact details of the responsible person ,
by means of a form published for that purpose by the Office on its website,
here: https://www.dataprotection.gov.sk/uoou/zo/register-zo
• the operator notifies the Authority in order to fulfill the tasks of the contact point for the Authority
in connection with the performance of the Office's tasks, also the identification data of the responsible person
within:
1. natural person - title, name, surname
2. legal entity - name, identification number
5. On the basis of the analysis , the mediator shall find out that he is not obliged to have a designated responsible person according to the new one
legislation and
a. wants to designate a responsible person
• the responsible person must meet all the conditions imposed on the responsible person under
GDPR resp. Act no. 18/2018 Coll.
• the intermediary is obliged to draw up the designation (authorization) of the responsible person in accordance with
new legislation
• the intermediary is obliged to notify the Office of the contact details of the responsible person ,
by means of a form published for that purpose by the Office on its website,
here: https://www.dataprotection.gov.sk/uoou/zo/register-zo
• the mediator notifies the Office in order to fulfill the tasks of the contact point for the Office
in connection with the performance of the Office's tasks, also the identification data of the responsible person
within:
1. natural person - title, name, surname
2. legal entity - name, identification number
b. does not want to designate a responsible person
• the broker does not take any action
6. Based on the analysis , the mediator will find out that he is obliged to have a designated responsible person according to the new one
legislation
• the responsible person must meet all the conditions imposed on the responsible person under
GDPR resp. Act no. 18/2018 Coll.
• the intermediary is obliged to draw up the designation (authorization) of the responsible person in accordance with
new legislation
• the intermediary is obliged to notify the Office of the contact details of the responsible person ,
by means of a form published for that purpose by the Office on its website,
here: https://www.dataprotection.gov.sk/uoou/zo/register-zo

Page 4

• the operator notifies the Authority in order to fulfill the tasks of the contact point for the Authority
in connection with the performance of the Office's tasks, also the identification data of the responsible person
within:
1. natural person - title, name, surname
2. legal entity - name, identification number
The obligations of the operator under the new legislation include the communication of contact details
designated responsible person of the Office. This requirement in Act no. 122/2013 Coll. was not, therefore, an obligation
each operator and intermediary to act in accordance with the above.
Failure to notify the contact details of the responsible person of the Office in accordance with the above form will be
for the operator or intermediary to mean that he has not fulfilled the obligation under Art. 37 par. 7 GPDR resp.
§ 44 par. 8 of Act no. 18/2018 Coll.
Should there be a change in the data reported to the Office since 25.05.2018, the Office will nevertheless
that the new legislation does not explicitly stipulate the obligation to notify changes in reported contact persons
data of the responsible person, recommends that operators and intermediaries also notify the Authority of any
change in such data. As the responsible person has to act as a contact point, it is essential that
could be reached by the Office (for example, in the exercise of supervision) and for this purpose the Office should have up-to-date
data of the responsible person. If there is a change in the reported data, the Office is required to make this change
to inform.
In conclusion, we draw attention to the fact that from 25.05.2018, in accordance with Art. 37 par. 1 GDPR resp. § 44 par. 1
Act no. 18/2018 Coll. the obligation to designate the responsible person not only the operator but also the intermediary, therefore
also the intermediary and the responsible person designated by him will be subject to the above-mentioned provisions of the GDPR resp.
Act no. 18/2018 Coll.

