Updated 8 October 2026.
A Slovenian website needs a compliance plan based on what the business actually does. A brochure site, an online shop and a service processing sensitive personal information have different obligations. Start by identifying the data you collect, the services you offer and the people you serve.
Privacy: GDPR and ZVOP-2
Slovenia’s personal-data framework includes the EU General Data Protection Regulation and the national Personal Data Protection Act, ZVOP-2. The Slovenian government confirms the new national act entered into force in January 2023 in its ZVOP-2 announcement. Read the GDPR itself when assessing the duties relevant to your processing.
Inventory contact forms, accounts, orders, newsletters, analytics and third-party embeds. For each, document the purpose, responsible party, lawful basis, recipients and retention decision. A privacy notice should reflect that inventory, rather than an unrelated template copied from another business.
Audit cookies and other tracking
Inspect what the live site loads before and after a visitor makes a consent choice. Classify technologies by their actual purpose. The Slovenian Information Commissioner’s cookie and tracking guidance is a primary reference for the local requirements.
Do not assume that displaying a banner blocks tracking. Test analytics, advertising tags, chat tools, embedded videos and third-party fonts at the network level. Where consent is required, make the implementation follow the visitor’s choice and provide a usable way to change it. Check that rejected technologies do not silently reload on the next page.
Accessibility: establish scope before choosing a checklist
Accessibility obligations depend on the operator and service. The European Accessibility Act directive includes ecommerce services, but scope, exemptions and national implementation require a business-specific assessment. Do not assume that one technical checklist proves compliance for every website.
Use WCAG 2.2 as an engineering reference for making content and interactions accessible. Assess navigation, forms, checkout, focus visibility, contrast, meaningful images and error recovery. Automated checks should be complemented by keyboard and assistive-technology testing.
Hosting, processors and transfers
Record where personal information goes, including support platforms, backups and analytics services. Review processor agreements, access controls and retention arrangements. Hosting geography alone does not settle every question about international transfers; remote access and third-party services also matter.
Have the appropriate specialist review the transfer arrangements that apply to your actual providers. Maintain an incident-response contact and a recovery procedure so the operational team knows what to do if information is exposed or the website becomes unavailable.
Business information and ecommerce terms
Review the information a customer sees before submitting an enquiry or placing an order: business identity, contact methods, pricing, delivery conditions and the applicable consumer terms. Confirm language, tax and sector-specific requirements with qualified local advisers. The correct answers depend on what you sell and to whom.
A launch checklist
- Document data flows and keep the privacy notice consistent with them.
- Test the consent implementation on every template.
- Review third-party processors, access and retention.
- Complete an accessibility assessment appropriate to the service.
- Review consumer-facing language and commercial terms.
- Assign owners for periodic checks and legal changes.
Frequently asked questions
Does a cookie banner make a website compliant?
No. Its wording, choices and actual control of tracking must match the relevant requirements and the site’s behaviour.
Is WCAG automatically the entire legal requirement?
No. It is a technical reference. Applicable legal scope, national rules and contractual obligations need separate assessment.
Is this a substitute for a legal review?
No. Use this guide to prepare a technical inventory and questions for a qualified adviser familiar with your business and Slovenian law.
For implementation work after that review, explore our website services or request a technical assessment.
For a working example, see our own privacy policy, cookie policy and terms and conditions, and the regions we serve worldwide.
Want this handled for you?
We build and optimise sites like this every week. Book a free 30-minute call and we will tell you exactly what we would change on yours.
Get a free site review
