IT, AI and personal data protection

When providing IT services, developing software or operating online platforms, the right setup of contracts — SLAs, licences and terms of use — is decisive. We have many years of experience with this, including network security and the regulation of communication technologies.

SLA, SaaS and software development

We will set up the cyclical provision of IT services (SLA), the licence terms for SaaS, as well as relationships with the creators of copyrighted works — internal employees and external suppliers alike — so that both sides are protected.

Every deployment of artificial intelligence carries individual legal risks — from liability and data security through copyright to ethical frameworks. An initial analysis and a well-drafted user agreement are the right first step.

The Artificial Intelligence Act: what applies and from when

Regulation (EU) 2024/1689 (the AI Act) is the first comprehensive legal framework for artificial intelligence. The ban on selected practices and the obligation to ensure employees' AI literacy apply from 2 February 2025, the obligations for general-purpose AI models (GPAI) from 2 August 2025, and the obligation to label AI-generated content and to inform people that they are communicating with a machine from 2 August 2026. Regulation (EU) 2026/1744, the so-called digital omnibus, postponed the obligations for high-risk systems: for the areas under Annex III (employment, lending, education, critical infrastructure) they apply from 2 December 2027, and for AI in regulated products from 2 August 2028. We will assess which category your system falls into, whether you are a provider or a deployer, and what you must meet by which deadline.

The protection of personal data is governed by Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. We will ensure compliance from the audit and documentation, through privacy policies and data processing agreements, to the setup of data subjects' rights.

Supervision and fines

Supervision is carried out by the Office for Personal Data Protection of the Slovak Republic, which inspects small companies too and may impose a fine of up to EUR 20 million or 4 % of annual turnover. In the event of an inspection or a complaint we will represent you before the Office, prepare statements and propose corrective measures.

Cookies and protection of personality

Alongside the GDPR, we address cookies and online marketing under § 109 of Act No. 452/2021 Coll. on electronic communications, and the protection of personality under the Civil Code — including the removal of untrue or discrediting mentions and the exercise of the right to be forgotten.

New European regulation places increased demands on companies in the area of cybersecurity and data sharing. We will assess whether it applies to you and set up the obligations so that they fit your business model.

NIS2 and the Data Act

In Slovakia, the NIS2 Directive has been transposed by an amendment to Act No. 69/2018 Coll. on cybersecurity, effective from 1 January 2025. The obligations now cover medium-sized and large companies in 18 sectors, including manufacturing, transport, energy, healthcare, digital services and their suppliers. The National Security Authority supervises this. The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025 and gives users of connected devices and services the right to the data they generate, and governs data-sharing agreements and switching cloud provider. We will assess whether they apply to you and set up the obligations so that they fit your business model.